Exploit question

[Talon]

I'm opening a server very soon, I've also included a few NPCs to make it looks more attractive, so here comes to my mind, is it possible players type in @command, @getitem, -10000zeny, $setcharid etc etc.. in NPC's chat or using something hacking tools? Would it be exploitable when scripts aren't written properly? I'm quite curious about these stuff when the server is opened and can't be roll back...

Maybe some of you got some experiences about this? Please answer 

[Emistry]

Would it be exploitable when scripts aren't written properly? 

definitely yes in some cases..

 

is it possible players type in @command, @getitem, -10000zeny

if you configure wrong @command permission...

[Playtester]

There's no hack to use @ commands even though players don't have the permission to use them. So the only risk is that you give the command to the players in the first place or someone hacks you database and changes his admission level (but in that case you're doomed anyway, so better put a good database password).

Within scripts you need to very careful.

Most important rule:

Always first substract zeny / ingredients BEFORE giving reward.

[Doch]

Always you code something, you have to think that the user is a little bastard that he won't type the correct values (per example) and will search a way to f*** you, so you have to think everything to just allow the user type what you want ( i.e you don't want negative values, letters..)

Edited October 2, 2014 by Doch

[Talon]

Thanks for the tips guys, hopefully the NPCs' scripts in my server are safe for use, because they are quite a few official NPCs' scripts in rAthena are still buggy, because it takes away my zeny when I decline the deal or there's no option to cancel the service e.g. broadcaster and stock-market which takes away my zeny even I cancelled the deal.   but it's okay, I've managed to changed the code to work differently.

Edited October 3, 2014 by Talon