> That's the problem with javascript, kinda hard to prevent people from screwing around and editing it in-place. Not if you use a module pattern with private m

> That's the problem with javascript, kinda hard to prevent people from screwing around and editing it in-place. Not if you use a module pattern with private methods. But the real problem you should be addressing, and one which applies to any internet app, is people directly sending data to the server. Whether it's initiated by JS or flash or anything is not relevant - sure it's sometimes easier to hack about with JS apps, but if you fix people being about to open telnet and spoof the raw data, then you fix all those holes at the server, and that leaves you free to entirely change the way your code works in the future, instead of having to re-code misguided security fixes.