Online highscore lists...

[Mickey Crocker]

I know this is a newbish question that can't be answered by a simple "oh, here is how it's done." But...

How does one go about creating a highscore lists that would post all the scores of players from downloadable games, much like puppygames.net.

I know this will be a long journey from beginning to end, but I'm just looking for the basics of where to begin my self-teaching. Should I be looking at php? or ASP? Any online tutorials on how I would send this information from a game to a database? Any good online tutorials on databases? Anything else I should know or be looking for?

Thanks for any help. (I feel like such a tool asking this :( )

[Hamumu]

I use PHP. The game effectively loads up a webpage (using sockets and stuff, so it's not like it's actually starting up the browser), like "putscore.php?myscore=3498754JHSY2873HS", which is some sort of hashed up, encrypted score value. The php program decodes that and stores the result in a DB and echoes out a 'webpage' that looks like:

Y

which the program reads as "yes, score was accepted". Very simple! I do other fancy stuff like compare it to a list of checksums of legitimate levels, so only scores obtained on an unmodified level are accepted (of course they can still hack it twenty ways, but at least they can't just use the level editor to put fifty Big Axes in the level).

[Dom]

We use PHP and MySQL. Same thing as Hamamu says - the game opens a TCP socket to the webserver and sends a properly formatted HTML request to our highscores page (we used a network sniffer to get what we needed to send) and use an encrypted string for the score, level, etc. Our script then returns the position in the daily highscores, as well as the highscore table for +/- 5 from that position which the game displays for them.

Also, if an hour has passed since the last 'update' of the database, we trawl through the submitted scores and 'retire' any scores over a day old to an 'all-time high score table', and prune any entries over the limit (10,000 max).

We also have a set of pages on the site that read this database and let the user search it by name or position.

As a further bonus, we have a strategy mode (combo challenge), and we store the best combo the player made in their game, and added a small Java applet so you can see a replay of the best combo!

PHP & MySQL rules :)

[princec]

We used Java RMI to do it, and connect to our own little custom RMI server. The web page bit is just a PHP query to the database.

We will be switching to HTTP tunneling RMI soon to bypass firewalls.

Cas :)

[Raptisoft]

High score guys, I'm curious: what kind of checking do you do? I know some games actually story every move, then replay the game on the server to see if it's a "real" score. I can't imagine that working for something like Alien Flux or Dudester.

How do you make sure it's not a hacked version of the game, that scores triple, or something?

[princec]

Well, fortunately very few people buy my games so hacking's not really a problem :) Also, the various figures have to correlate with each other. It's pretty easy to spot a cheat if some of the figures are way out of their expected range. Otherwise I don't do any checking.

Cas :)

[oNyx]

>How do you make sure it's not a hacked version of the game, that scores
>triple, or something?

You can't be sure about that ever. And most people won't hack the game. Instead they would just use a sniffer and send some modified packets or just use their browsers (add an agent and referrer check for making that method a bit annoying).

The best thing are of course replays, but that doesn't work for a lot of games. So... add some stats to the score query. Like playing time, the level, number of shot down enemys etc. Then just check the top score every once in a while (no one will cheat for place 238) and see if it makes sense. If not, remove it.

[Raptisoft]

Hm. I would implement online high scores, except that I don't want to watch these things. It seems like a simple Xor key (server sends Xor key, program sends back data with key + record) would halt the packet sniffing.

I'm more concerned with people who actually modify the program. For instance, when I had net scores in Eggsucker, someone put out a patch that scored 3x points for everything gained.

Not to mention that Osama Bin Laden himself scored on my high score list (with a pretty high score, btw. I was mad, because he clearly got a cracked copy of the game, was nowhere in the purchase record list. But I guess you have to expect that. He is Osama bin Laden).

[Hamumu]

Yeah, it's always the rich people who steal software, bastards. Also, they kill people.

I don't worry about someone hacking it. I know it can be done - I found a trainer for the original Dr. L long ago that did all kinds of cheating. If scores get out of whack, I'll remove them. I did in fact have to remove and ban some scores, because while the high score data is all secure, the profile data (# of enemies killed, # of grasses chopped... lots and lots of others) is kept in a normal file, just a straight series of numbers with no checking. So a couple guys modified their profile files to be 'funny', resulting in ridiculous results. Easy enough to make it not accept scores from those usernames though. And they felt bad about it. It helps when you have a friendly little community instead of the whole wide world of snotty teenagers.