Could the client deliberately send incorrect parameters in a remote event that could cause the code to error and would the error cause issues with the entire script?
my code
is it necessary to protect against that with a pcall for example or am I fine without?
and if so how would I apply a pcall and connect it from a remote event
Yes. The only argument you can trust is the first, implicit, player argument. Malicious users can fire any remote event with any arguments at any given time. I always use the following function for this reason:
local function nAssert(value, player, message)
assert(typeof(player) == "Instance" and player:IsA("Player"), "bad argument #2 to Network.NAssert, expects Instance<Player>")
assert(typeof(message) == "string" or message == nil, "bad argument #3 to Network.NAssert, expects string?")
-- assign message to its default value if no value is provided.
message = message or "An error occurred."
-- if value is falsey, kick the player with message.
if not value then
player:Kick(message)
end
return value
end
This code will kick the firing player if the arguments are of an unexpected type. Some developers may choose to just return from the listener instead of kicking player to account for mistakes on their end resulting in innocent players being kicked—it’s up to you.
Like Dandystan said, you should check everything.
Keep in mind that this function is called in its own thread, so technically nothing bad has to happen if it errors.
Also
local obj = game.ReplicatedStorage.Objects[building]
if obj then
isn’t any good, because it will error if obj isn’t there
You need:
local obj = game.ReplicatedStorage.Objects:FindFirstChild(building)
if obj then