Users executing javascript in url

[Beffic]

As title says my users are entering valuable javascript functions manually in the url. How can I stop this?

It is exploiting my scripts and "cheating" my website.

[Bonesnap]

Can you provide some more information?

[Beffic]

Your browser url bar: Javascript: fightEnemy();

[Bonesnap]

That didn't really tell me much more, but a quick Google search yielded a result with a quote that I think applies:

No. You can't, anyway, as it doesn't get sent to the server.

That is just JavaScript executed locally by the user themselves. It should mean nothing to you. The security of your system should never rely on client-side javascript, all your authentication, and so on, should be done server-side.

[Beffic]

So I am basically just better off opening my page in a new window and disabling the url bar?

[Beffic]

That javascript is ajax so when people run it, it is executing php problems way faster than it should

[Bonesnap]

Beffic;11005378 wrote:

That javascript is ajax so when people run it, it is executing php problems way faster than it should

Then you need to verify that the script should be running, and if not, then handle it appropriately. There has to be some verification being done on the server-side, such as is the player even logged in?