Yeah basically, something secure should check if :
- the game sent your score (and not by any other way)
- you already sent your score (avoid flood)
Because even I can code an evil application that will call "http://myurl.som/myscoringscript.php?user=plop&score=999999999" a thousand time :D
The question is, how to be sure that it is your game that sent the values. And not an evil application or just a user entering the url in his web browser?
Maybe you could generate a shared value between your server and the game like a random sessionID inside the game itself.
But I think even that can be hacked looking at javascript values...
So yeah, no real good solution yet.