I'm posting my game. I've lost the desire to work on it or do anything else. It's fine as a core, everything seems to work, but there are a few bugs. I doubt there are any holes; I think I've checked all the filtering in the . PDO is used for database access, which is good for protecting against SQL injection attacks. Optimization: The nick function has a static cache to avoid repeated database queries for the same user on the same page. Global variables: The code relies on $pdo and $user, which is typical for procedural engine writing.