Validating every server request

A client can be modified, delayed, or mistaken. Coin Quest must make its own decision from server-observed state.

Validate shape first, then locate server-owned objects, then check state such as ownership, distance, cooldown, and permission.

Reject with minimal public detail and keep the authoritative update after every guard.

--!strict asks Studio to check your code for type mistakes. It is an instruction for the editor and produces no Output message.

Matching quotes such as "hello" surround a string: a piece of text. The quotation marks tell Luau where the text starts and ends.

print(...) calls the built-in print function. Put the values to show inside its parentheses; separate multiple values with commas. Read the result in Studio's Output panel.

local is read as “local”: it creates a name that is available only in the current code scope.

== is read as “equals equals”: it compares two values and produces a boolean.

~= is read as “not equal”: it asks whether two values differ.

if is read as “if”: it starts a decision by evaluating a condition.

then is read as “then”: it marks the body that can run when the condition is truthy.

end is read as “end”: it closes a block such as a decision, loop, or function.

Read one statement at a time: name the value being read, what the operation does, and where its result goes. Keep identifiers exactly as written so you can find them again in the code.

Pause at calls, conditions, and loops. Explain when the body runs before moving to the next statement; use the line notes above when a symbol is unfamiliar.

Start with the statements outside function bodies. A function definition creates a callable value; its body runs when a call, event, or scheduled task reaches it.

Trace the arguments at each call and the branch or loop inside that call. Return to the caller when the function returns. For an event, use the action named in Try it to trigger the callback.

Line 3: The function receives trusted Player identity and unknown client data.

Line 4: Type and length are checked before lookup.

Line 8: Character state comes from the server.

Line 9: The server resolves the ID inside an allowed folder.

Line 10: Missing and wrong-class objects are rejected.

Line 14: Distance is calculated from server-visible objects.

Before running, identify the starting values and any existing Studio objects this example needs. List what you expect to change.

After your practice change, check this result: Every invalid category returns before any authoritative mutation.

Reading or printing a value leaves it unchanged. Look for assignments, calls that change state, and property updates to explain each change you observe.