Quote Originally Posted by RichardKnox View Post
On a text RPG i'm developing I realised that if users really wanted to they could navigate to 'ability.php' and just rank up there abilities without actually winning fights. So what I've seen as a way around this is on 'fight.php' you generate a MD5 code of a random number between say 1 and 1 billion and then store it in a sql database. When the user then goes to 'ability.php?key=uniquekey' the database is checked to see if the key is valid and if it is destroys it (in the database) so the same key cannot be reused, if the key is not valid the page simply spits out an error message to them.
That would only protect it from CSRF. If they are using an autoclicker then it wouldn't make a difference.