With http requests and php you need a good authentication logic and encryption. Players can easily check your http requests and responses and may reroute some requests to other places(local http server) and return a response from there to make it look like they have been authenticated as a player that is non-existent or a different one. Using same methods they can also fake stats. That is also possible with packets used between gamestuio client and gs server but that's a lot harder.