Writing server events that cannot be abused

Cheat menus ship with lists of event names from popular scripts, and one unprotected TriggerServerEvent('job:pay', 999999) is enough to wreck a server’s economy. The fix is not hiding event names; it is writing every server event as if the person calling it is hostile — because sometimes they are.

RegisterNetEvent('fishing:sell', function(amount)
    local xPlayer = ESX.GetPlayerFromId(source)
    xPlayer.addMoney(amount * 50)
end)

The client decides amount. A cheater calls TriggerServerEvent('fishing:sell', 100000) and gets five million.

local SELL_POINT = vec3(-1845.0, -1195.0, 14.3)
local PRICE = 50
local last = {}

RegisterNetEvent('fishing:sell', function()
    local src = source
    local now = os.time()
    if last[src] and now - last[src] < 5 then return end
    last[src] = now

    if #(GetEntityCoords(GetPlayerPed(src)) - SELL_POINT) > 5.0 then
        print(('[fishing] %s tried to sell away from the market'):format(GetPlayerName(src)))
        return
    end

    local count = exports.ox_inventory:GetItemCount(src, 'fish')
    if count < 1 then return end
    if exports.ox_inventory:RemoveItem(src, 'fish', count) then
        exports.ox_inventory:AddItem(src, 'money', count * PRICE)
    end
end)

AddEventHandler('playerDropped', function()
    last[source] = nil
end)

The client now sends nothing. The server counts the fish it knows about, removes them, and pays a price only it knows.

source is a global that FiveM sets for the event currently running. If your handler waits (a database query with MySQL.query.await, a Wait), another event can run and change it. Copy it into a local on the first line and use only the local.

• Events that only server scripts trigger: AddEventHandler('myres:internal', ...) without RegisterNetEvent — clients cannot call them.
• Better still, use exports for server-to-server calls — see exports.
• For client requests that need an answer, use a callback (lib.callback) and validate inside it exactly like an event.
• Never send secrets, other players’ data or admin lists to clients with TriggerClientEvent(-1, ...).

A validation failure is either a bug or an attack. Log it with the player’s name and identifiers; a burst of refusals from one player is your best cheat detector. For weapon-specific checks see weapon anticheat validation.