Question

Thanks to the recent browsers enhancements, developing games with canvas and javascript has become a good option, but now that the code is easily accessible, just writing

javascript:score=99999

or

javascript:lives=99

Will spoil the game objectives.

I know that with some server-side checking something can be done, but I would prefer to access the server just to store player stats at the end, or even have it client only in most cases.

I wonder if at least the are some best pratices to start with.

(using not so obvious variables names is a start, but not enough)

-Added-

Thanks for the replies, I was looking to improve the client-side code, enough to stop “casual hackers”, but still leaving the code as clean as possible.
Anyone that really wants to hack it will succeed anyway, even with server-side checks, as I’ve seen it in many flash games.

Answer 1

I’ll say what I said at my comment: put every source code in (function(){ }());. Then, the variables and functions can’t be accessed from outside.

Example:

(function(){
    var a = 'Foo';
    var b = 42;
    function helloWorld(a,b){
        for(i=0;i<b;i++)console.log(a);
    }
    helloWorld(a,b);
});
//Can't access to a, b, or helloWorld using javascript: or default console of Google Chrome,
//but people still can see by looking source code and may be modified by other tools
//(see comments of Tom & user120242)

I ‘learned’ this technique this when I dig into Les Paul Google Doodle.

To be more secure (not completely secure, but it’ll annoy some hackers), compress and obfuscate your script by tools something like YUI compressor or packer.