Both client-side and server-side validation for my game

Question

I'm making a multiplayer game, where players (1 up to 4) put items on the board (multiple items per move are permitted) one by another. The game is ajax-based. The rules of placing items on the board are pretty complicated, plenty of combinations are forbidden.

What I want to achieve is performing moves validations immediately when player places his item on the board, so there's no lag. He knows if his move is valid or not in no time. Then, the same rules are being checked on server-side, once the move is submitted. This is of course for security reasons, to deal with ajax spoofing. What I'm sending in the request is just a map of items IDs and fields indexes. On the server I'm checking tons of stuff, including whether all those items belong to the player who is permitted to move now and if those items can be put on these particular fields.

I'm thinking about the best practice to validate fields indexes. Now, I have two completely separate scripts, JavaScript one and PHP one. Is there any way to make it more flexible, so if I decide to change the rules, I could change it on both sides? I know I could do some rules mapping object and then write interpreters for both sides, but those rules are too complicated to work with any map like that.

Answer 1

Just a thought.

You could write all your game rule logic in a separate Javascript file in an easy to consume way.. Since this can be run on the client side that problem is out of the way.. And then using this (se link) PHP functionality call the same javascript code from within PHP and test moves for validity.

http://php.net/manual/en/v8js.examples.php

This way you can write your rules once and run them on both sides without having to rewrite them.

---

If you cant do something like this I would make the server calculate all possible moves for each game piece at the start of each round and send them to the client to present as possible actions. This way you client has no game logic but can still present valid moves without making queries for each one.

This also has the benefit of only having your rules on the server side and not letting people in to the details of how you are checking them.