Great Game

I like the concept of the game.. reminds me of empire wars on Facebook but its different..

I think it still needs a lot of fine tuning.. in particular the battle system for how powerful the units are.
but the game is still in beta and IMO is awesome so far.

some points I'd look at reworking...

1) battle system
2) Unit numbers to be reworked
3) mission ordering
4) Reward system for the Wave System does not give the correct reward.
5) Much more intuitive Faq
6) Store lists of units should be split into 2 groups.. credits and coins.. with credit purchases at the top.. then coins underneath.. both lists if more than one unit should be ordered highest to lowest or even not have then appear if all requirements are not met.. and link the list of units at the top of the page if peeps want to see them all.
7) Resources: Change the 'Start Drilling' link to 'In Progress' if a drilling/mining/cutting has been started. Also get rid of the progress image that means nothing and replace with a count down timer till completion.
Don't make people wait after they have completed several missions for capturing people.. allow it to finish immediately.

Thats all I'll say for now

but awesome job so far... cant wait to see it finished.

Cool Thanks

Im actually surprised none of your other 'beta testers' found these obvious bugs and exploits.. in particular the higher ranked ones.. seems they took advantage of them. Guess they only came for the titles.

I'd also have extraair close down that chat site... you shouldn't have or allow anything that takes people away from the game and the official forums. Hes also proven himself not trustworthy on the other game.. so i wouldn't give him to much leeway on here.

Personally.. I'd remove all privileges of everyone until they prove themselves as beta testers and are not here just for the titles etc...

ok i've looked through the site more.....

I'm not really sure if your testing things or not.. but lots of simple errors are evident.

most systems say one thing and do something else.. there's no form security.. has me curious about login security. hopefully your using sha256 encryption at the very least with throttling or blowfish encryption.

I'd stop asking for features for now.. and try to fix everything first.... basic rule of thumb.. get something working.. then test it 500 times for its behavior and if it has a problem.. solve it and test it 500 more times until you can use it 500 times without an error.

You have an excellent idea... excellent starting base.. but now you need to secure it and fix it.

Once you have the content you have now working relatively bug free.. then worry about getting players in.. right now you could lose everything you have with a mediocre hacker as it is now.

still .. looking forward to it being fixed.. will be an enjoyable game

What simple errors are you talking about? All form fields should be protected from sql injection by a anti injection function I wrote. Could you give me a idea of what you mean?

the info is here...

http://www.rodsdot.com/php/CSRF_Form_Protection.php

its not the one i wanted to show you but it gets the point across very well

I should be protect against this. (apart from the waves battle thing you pointed out)

this is a great article on login security

http://stackoverflow.com/questions/549/the-definitive-guide-to-forms-based-website-authentication

I am using a md5 encryption.

md5 has not and cant be cracked...

Meaning no one will get the passwords people enter... How ever...

it does suffer from multiple collisions meaning that hackers do not need to get the password.. just a collission

you need to change md5 to sha256 at least.

What dies sha256 do?

Its a newer password encryption that no collisions have been found for yet

https://www.owasp.org/index.php/Guide_to_Authentication

scroll down to min 'Minimum hash strength'

I will look in to changing from md5 to sha256.