How to I prevent a user from running a module twice (i.e. online voting) ?

[Al Dykes]

I've got a voting script that's a little too simple. I can vote as as
many times as I can click on the link in my browser.

I'n not trying to write an official voting system but I would like to
do something as simple as catching the user's IP address and
remembering it for a time interval. That has it's own problems, but
it would at least prevent double clicks.

I can get the IP #, but how do I store it on a server? I can do a flat file
or something.

Any other suggestions or code are welcome.

I'm new to PHP.

Thanks.

--
a d y k e s @ p a n i x . c o m

Don't blame me. I voted for Gore.

[xclarky]

You could store it in a file yes, a MySQL backend would be better
though.

I assume you know how to append data to files, with this you can add IP
addresses with a divider (new line, tab, any character you like). You
can read that file during the processing of the poll and create an
array of IP's:

[PHP]
$voted = explode('MYDIVI DER', $contents_of_fi le);
[/PHP]

You can then check the current visitors IP against this array:

[PHP]
if(in_array($_S ERVER['REMOTE_ADDR'], $voted)) {
die('You have already voted!');
{
[/PHP]

I hope that helps.

[Sjoerd]

> I've got a voting script that's a little too simple. I can vote as as

many times as I can click on the link in my browser.

Store a cookie at the client side (use setcookie()) and check that to
see if the user has
already voted. Of course, this is fairly easy to bypass: just disable
cookies. You can store an IP on the server, but multiple people can
come from one IP address. If your site is not very busy, you can store
one IP: a user can vote multiple times, but has to wait till any other
user has voted.

[Gordon Burditt]

>I've got a voting script that's a little too simple. I can vote as as

many times as I can click on the link in my browser.
Isn't that about the same as electronic voting in the United States?
I'n not trying to write an official voting system but I would like to
do something as simple as catching the user's IP address and
remembering it for a time interval. That has it's own problems, but
it would at least prevent double clicks.
Beware of false positives (different people in the same office
voting through a NAT gateway or web proxy that makes them all appear
to have the same IP) and false negatives (dialup user who gets a
different IP every time he dials up).
I can get the IP #, but how do I store it on a server? I can do a flat file
or something.

Flat files have their problems, like locking when you've got several
voters updating the flat file simultaneously. But you can use them.
Look at functions like fopen().

Think about using a database (e.g. MySQL) backend. It's easy to
write a query like:

select count(*) from votesdone where ip = '$ip' and
stamp > subdate(now(), interval 24 hour)

If it returns a number greater than 0, that IP has voted recently.
If it returns 0, it hasn't.

Databases are good at locking, so you can lock the table, check if
they already voted, if not record their vote, and unlock. Or use
transactions.

Gordon L. Burditt

[d]

"Al Dykes" <ad****@panix.c om> wrote in message
news:ds******** **@panix5.panix .com...

I've got a voting script that's a little too simple. I can vote as as
many times as I can click on the link in my browser.

I'n not trying to write an official voting system but I would like to
do something as simple as catching the user's IP address and
remembering it for a time interval. That has it's own problems, but
it would at least prevent double clicks.

I can get the IP #, but how do I store it on a server? I can do a flat
file
or something.

Any other suggestions or code are welcome.

I'm new to PHP.

Thanks.

Think how they do it in real life :) Make sure everyone who wants to vote
has a username/password - simply ask for that before voting, and then you
know if a user has already voted or not.

--
a d y k e s @ p a n i x . c o m

Don't blame me. I voted for Gore.

[Barry]

the simplest, unsecure way of doing it is to use cookies.
when a user votes, check if a cookie exist
if it does, he cannot vote
if it doesn't , he can vote
after the vote, write a cookie

problem is, the user can clear all cookies and vote again.
so, it all depends on how secure you need it to be.

Barry

d wrote:

"Al Dykes" <ad****@panix.c om> wrote in message
news:ds******** **@panix5.panix .com...

I've got a voting script that's a little too simple. I can vote as as
many times as I can click on the link in my browser.

I'n not trying to write an official voting system but I would like to
do something as simple as catching the user's IP address and
remembering it for a time interval. That has it's own problems, but
it would at least prevent double clicks.

I can get the IP #, but how do I store it on a server? I can do a flat
file
or something.

Any other suggestions or code are welcome.

I'm new to PHP.

Thanks.

Think how they do it in real life :) Make sure everyone who wants to vote
has a username/password - simply ask for that before voting, and then you
know if a user has already voted or not.

--
a d y k e s @ p a n i x . c o m

Don't blame me. I voted for Gore.