[Stuwee]

Originally posted by Lesane
You could use sessions for that.

When they are going to the play action (tetris?action=play) then you can set a session name for example:

PHP Code:

session_start();
session_register("test"); 


Then by the code of reg (tetris?action=reg) you can check if the user has a session named test by the following code:

PHP Code:

if (session_is_registered("test")) {
echo "User has a session named test so he came from the play action";
} else {
echo "ooops, cheatterr";
} 


Quite right, but as far as I can see, the cheat0r could just start a game, and then while it's playing, submit the form. The session still exists, but it wasn't submitted by the script... the leaderboard would be none the wiser. $_SERVER["HTTP_REFERRER"] could always be checked to see if the user is indeed coming from the playfield, but there's no reason that can't be poisoned either....