MySQL might be overkill but that depends on your plans.
If this is going to be a triva game for a few select people or it's an educational thing, the CSV will work great.
If you plan on this being a commercially viable product, I don't suggest the CSV.
- Always assume your code will get hacked into.
- The URL to a CSV file will be exposed somewhere in the code most likely.
- Someone WILL directly access that CSV and do what they will with all of your data.
While AJAX calls to scripts that load data from a MySQL are a pain in the arse, require skills in coding and still aren't completely fool proof, it does add a mostly secure layer between your customers and your data.