[de90]

The way you prevent cheating in a game like this is that the game itself runs on the server. The client side is merely showing a representation of the server state. If people want to edit the scripts to show an invalid state who cares. Granted latency becomes a huge challenge, but in a perfect world (no latency) having the scripts on the clients side and having people edit them isn't a big deal

[T-hawk]

Easily said, but the challenge is making absolutely triple damn sure that the game running on the server is bulletproof against malicious input by the client. It took years for early games like Diablo and Everquest to get it right in ignoring a client sending position updates to move a character faster than nominally allowed by the game logic. And that's the tip of the iceberg.

You also have the problem of hidden information. Most games have a fog of war or simply walls that should obscure some part of the game state. If this is sent to the client, somebody will expose that information: maphack. It's not at all a trivial problem to define and send only exactly the slices of the game state that the client should have access to.

And any game where timing matters is subject to auto-aim bots and other such cyborg-style assistance to the players. Bomberman is subject to this: imagine a browser plugin that automatically moves your character out of range of a bomb in the last few instants before it explodes.

[dubcanada]

The "fog of war" is actually really easy to do. And most games that use "fog of war" already have parts in place for this.

Checking client input is rather difficult, but it's no more difficult then developing the game itself. Just a lot of hassle and checking.

Even if you do all this stuff, people can still break it. Look at pretty much every game made. There are ways to cheat.