HTML5/PHP. Защита от подмены пакетов

У меня имеется HTML 5 игра и некоторые проблемы с защитой этой игры.

1. Предотвратить повторную отправку POST через AJAX.
2. Защита от подмены пакетов.

Сам я накатал на коленке, но получилось не очень. Ну так вот, есть ли у кого пример или ссылки на мануалы?

Код: config.php:

<?php
session_start();
header('Access-Control-Allow-Origin: *');
header("Content-Type: text/html; charset=utf-8");
include_once 'function.php';
$admin_login = '123';
$admin_password = '123';
$module_mysql = new module_mysql();
$module_db_host = 'localhost';
$module_db_name = 'n96582pg_deadfld';
$module_db_login = 'n96582pg_deadfld';
$module_db_password = '89059325694';
$module_mysql -> connect_mysql($module_db_host, $module_db_login, $module_db_password, $module_db_name);
?>

function.php:

<?php
class module_mysql {
    function connect_mysql($db_host, $db_login, $db_password, $db_name){
        mysql_connect($db_host, $db_login, $db_password, $db_name) or die ("Error connecting to MySQL: " . mysql_error());
        mysql_query("set names utf8") or die ("<br>Invalid query: " . mysql_error());
        mysql_select_db($db_name) or die ("<br>Invalid query: " . mysql_error());
    }
    function query_mysql($mysql_data_query, $type, $num) {
        if ($data_query=mysql_query($mysql_data_query)) {
            switch ($type) {
                case 'num_row' : return mysql_num_rows($data_query); break;
                case 'accos' : return mysql_fetch_assoc($data_query); break;
                default: return $data_query;
            }
        } else {
            print 'MySQL error: '.mysql_error();
            return false;
        }
    }
}
class module_functions {
    function screening_function($function_data_screening) {
        $function_data_screening = htmlspecialchars(trim($function_data_screening));
        return mysql_real_escape_string($function_data_screening);
    }
    function get_hash($login, $password, $level) {
        switch($level){
            case '1' : return md5(md5($this->screening_function($login . $password)) . 'Cv7X2WVdjSGEwNFInieora45WKRxpcef');
            case '2' : return md5(sha1(md5($this->screening_function($login . $password)) . sha1('Cv7X2WVdjSGEwNFInieora45WKRxpcef')));
        }
    }
    function error_print($error) {
        $r=''."\n".'';
        foreach($error as $key=>$value) {
            $r.=''.$value."\n".'';
        }
        return $r.'';
    }
}
class module_global {
    function module_newuser($login, $password, $received_hash) {
        $module_functions = new module_functions();
        $module_mysql = new module_mysql();
        $this_hash = $module_functions->get_hash($login, $password, '1');
        if($this_hash == $received_hash){
        if(empty($login) or empty($password)) $error[] = 'All input fields are required.';
        if(strlen($login)<6 or strlen($login)>18) $error[] =  'Login length should be from 6 to 18 characters.';
        if(strlen($password)<6 or strlen($password)>20) $error[] = 'The password must be between 6 and 20 characters.';
        $login = $module_functions->screening_function($login);
        if($module_mysql->query_mysql("SELECT * FROM users WHERE login_user='".$login."';", 'num_row', '')!=0) $error[] = 'A user with this name already exists.';  else return 'good';
        } else $error[] = 'Invalid hash.';
        if(isset($error)) return $module_functions->error_print($error);
    }
    function module_auth($login, $password, $received_hash) {
        $module_functions = new module_functions();
        $module_mysql = new module_mysql();
        $this_hash = $module_functions->get_hash($login, $password, '1');
        if($this_hash == $received_hash){
            if(!empty($login) or !empty($password)){
                $password = md5(md5($module_functions->screening_function($password)) . 'Cv7X2WVdjSGEwNFInieora45WKRxpcef');
                $login = $module_functions->screening_function($login);
                if ($module_mysql->query_mysql("SELECT * FROM `users` WHERE  `login_user` =  '".$login."' AND  `password_user` = '".$password."';", 'num_row', '')==1) {
                    print md5($this_hash . 'Cv7X2WVdjSGEwNFInieora45WKRxpcef' . $this_hash) . ' | ';
                    return true;
                } elseif($module_mysql->query_mysql("SELECT * FROM  `users` WHERE  `login_user` =  '".$login."';", 'num_row', 0)==1) {
                    $error[] = 'You did not enter the correct password.';
                } else $error[] = 'User does not exist.';
            } else $error[] = 'Enter data.'; 
        } else $error[] = 'Invalid hash.'; 
        if (isset($error)) print $module_functions->error_print($error); return false;
    }

    function module_reg($login, $password, $received_hash){
        $module_functions = new module_functions();
        $module_mysql = new module_mysql();
        if (($this->module_newuser($login, $password, $received_hash)) == 'good') {
                $password = md5(md5($module_functions->screening_function($password)) . 'Cv7X2WVdjSGEwNFInieora45WKRxpcef');
                $login = $module_functions->screening_function($login);
                if ($module_mysql->query_mysql("INSERT INTO `users` (`id_user`, `login_user`, `password_user`) VALUES (NULL, '".$login."', '".$password."');", '', '')) {
                    print md5($this_hash . 'Cv7X2WVdjSGEwNFInieora45WKRxpcef' . $this_hash) . ' | ';
                    return true;
                } else {
                print 'An error occurred while registering a new user. Please contact the property'; return false;
                }
        } else print $this->module_newuser($login, $password, $received_hash); return false;
    }
}
?>

function_ajax.php:

<?php
include_once 'config.php';
$module_global = new module_global(); 
if(isset($_POST['type']) && isset($_POST['login']) && 
isset($_POST['password']) && isset($_POST['hash'])){
switch($_POST['type']){
    case 'module_auth' : 
    if ($module_global->module_auth($_POST['login'], $_POST['password'], $_POST['hash'])) {
        echo 'true'; break;
    } else {
        echo 'false'; break;
    }
    case 'module_reg' :
    if ($module_global->module_reg($_POST['login'], $_POST['password'], $_POST['hash'])) {
        echo 'true'; break;
    } else {
        echo 'false'; break;
    }
}
} else print 'PHP error: invalid data';

?>