I am creating a top-down rpg character movement w/ combat. You click on a part of the map (in this case, it's a image, and your character .png image transitions to that spot). It's with Javascript and PHP. I'm using a PHP socket server. I have it where players can only move up to 200 pixels per each click. Each click is essentially a packet being sent to my gameserver. Then the gameserver validates if it's a valid input (1235x1235) format, and spits it out to other players in that specific game. (So it's a consistent world/map). This works perfect.
If I want to incorporate a monster that has AI and starts to attack the character... I can do that with javascript easily with setInterval or setTimeout functions (to make the mob move and then attack the character). But how do I do that serverside with PHP simultaneously? Because a user could just press F12 and edit the javascript to stop the mob from attacking. But, I need the mob to attack the player every xxx milliseconds serverside as well. How can this done with PHP? I feel like I need some type of heartbeat going on where it's a constant check between client and server every xxx seconds? I might be going off on the deep end and I'll stop talking I hope you get the jist of it. Any ideas are greatly appreciated.
Another thought: Think of the popular aRPG games out there. Diablo 2, Diablo 3, Path of Exile, etc. Imagine using a hack that just stops mobs from moving towards your character and attacking it. Is that just an illusion? And the "auto attacking" is done serverside regardless if you've stopped that mob on the client, right? If so, how to accomplish this with a PHP socket server with some Javascript? I'm not looking for code, just an application theory or design process would be awesome.
P.S. It's either I go this route, or the game becomes a simple real time strategy Pokemon style combat. Which I really, really don't want...
TLDR: How to have monsters auto attack your character (or in this case, update values in a temp variable, or a field name) server-side with some client-side JavaScript, and a php socket server. Securely on the server.