Hello 
,
I want to make a custom textbox where you can type in your Lua code. But the text of course isn’t Lua and how do you run text from a textbox and actually make it do stuff? I tried searching a bit on the forum but I don’t see any posts about it. In Lua Learning (a game) you also had the ability to type some text and it would actually run in Lua code. So I’m wondering how they did it and if there is an inbuilt feature to do this sort of stuff.
dont you mean the typewritter effect?
loadstring()
This runs the code in game, Lua Learning probably runs the code outside and only returned the output to for security
No, I mean that you can have a game. Then when any player goes into the game they can put in code in a textbox and then the game would convert it to Lua code and just run it just like a normal script but then in a textbox.
It works! I just had to turn on LoadstringEnabled which is one of the properties when u select ServerscriptService.
It’s a gigantic security risk though so only allow yourself to use it (even though developers have dev console)
Well, Yes, You can do it, But you would need to use a Binary String Reader (Used to read code and convert it)
But, A bad thing about creating that is that players can easily paste a exploit/cheat code inside the TextBox and execute it. If your goal is to create a game where players need to write code to proceed/beat the game, You would need to use/create a custom coding environment.
Like @Imaginalities Said, It can be a big risk, As most exploits use loadstring to execute code and get stuff from the Web.
Yes, someone could just make a crash script and ruin the game. But if the server only had 1 person inside it would it still be a security risk? Datastores would be a problem tho.
Just make the data store key something that the client can never know of.
Like userid through an encryption with a specific key that the client doesn’t know, really simple.
Is it possible to actually affect other servers with in game code?
I don’t think so. Btw the encrypted key method doesn’t work as ListKeysAsync exist. I think you can just block the string from being loaded when string.find(thestring, “thing want blocked”) returns true and obfuscated script detection (no idea)
I have to go now.
