Board Game Arena

The game is cribbage, the code is in the studio site along with a playable version

I am concern that users are able to pick out a specific cut card to benefit their hand. Maybe I am paranoid, but I have seen some strange plays pay off big.

I don't think it can be the basics is the user chooses a card which just returns a number from 1 to 40

Then the code just does a PickCard

$this->cards->pickCards( N, 'deck');

You are a premium member, so you may use hotseat mode to try it now

they can't hack the php server code.

but it's feasible that they can do anything client-side, so you have to protect against people calling your ajax action functions with their own (assume almost anything) arguments, and only allow plausible plays, like checking php side that the cards are in their hands, etc.

It's also possible that you could inadvertently pass valuable information to the client, like a face-down or an opponents card. You might pass the id which could infer the value/suit even though it's being displayed face down. Again worst case scenario, assume they can see and analyse all the gamedatas data.