[cbk1994]

Your latency is pretty high; you're in Germany and the servers are in Texas.

Here's how I would do it:

PHP Code:

// Weapon -Swords
function onActionServerSide(cmd, sx, sy) {
  if (cmd == "slash") {
    // security check: is the player too far away?
    if (getDist(player.x, player.y, sx, sy) > 4) {
      return; // player is too far away from the hit location
    }
    
    // security check: when was the last time they hit?
    if (timevar2 - player.lastHit < 0.5) {
      return; // player last hit less than half a second ago
    }

    temp.radius = 0.1;
    temp.npcs = player.level.findAreaNPCs(sx - radius, sy - radius, radius * 2, radius * 2);
    
    for (temp.npc : npcs) {
      // it's good practice to pass the player object rather than
      // the account—it's just the object-oriented thing to do
      npc.trigger("hitByPlayer", player);
    }
  }
}

function getDist(x1, y1, x2, y2) {
  return (((x1 - x2) ^ 2) + ((y2 - y1) ^ 2)) ^ 0.5;
}

//#CLIENTSIDE
function slashObjects(sx, sy) {
  temp.radius = 0.1;
  
  for (temp.npc : findAreaNPCs(sx - radiux, sy - radius, radius * 2, radius * 2)) {
    npc.trigger("hitByPlayer", null); // second parameter is only needed for v5
  }
  
  triggerServer("gui", this.name, "slash", sx, sy);
} 


This way, you don't have to worry about players tampering with a list of NPCs (it's also a pain to make that list since there's no easy way of identifying an NPC on clientside and serverside unless it's a putnpc2 or DB NPC; level NPCs don't have names and the IDs differ from clientside to serverside.)