Let's assume i have created a game, and then created ERC tokens (Example swords) so the player must buy a token to be able to play the game.
What if someone creates similar tokens in his wallet and injects them into my game as if they are bought from my tokens store

Its very easy to verify the fake tokens. Just verify contract address of that token. Because two tokens can have the same symbol but not the same contract address.