[Stuwee]

Riiiight... very nice game and all credit to you for that, but there are two glaring big holes in your script here which I feel somewhat obliged to point out.

First and foremost, even with your updated script, it's still 100% possible to cheat (by posting the values using a form instead of using the querystring). For example - this simple html form run on your own machine:

<form name="tetrischeat" method="post" action="http://yoursite/tetris.php?action=reg">
  enter your score! 
  <input type="text" name="punteggio"><br>
  and your userid (get from bbuserid field in cookie)<input type="text" name="userid"><br>
  <input type="submit" value="What's tetris again?">
</form>

It just requires digging out your userid from the vB cookie. For a working example, register on our boards, and then give it a shot here.

Secondly, the comment system here is very open to abuse. For example, as your comment, try:

<script>alert("i rock j00!")</script>

And you'll see what I mean. Luckily, the mysql comment column is restricted to 70 charaters, which limits the damage we can do with this (no XSS cookie harvesting kiddies, sorry)... but it can still be rather annoying.

Overall, a little more thought is needed here in order to secure the script properly. Let me know if you need any help with this, I'll be happy to help.