Limiting access by reading server logs and matching against client IP address.

[atyndall]

Basically,

I have a email script which (on the sending of the email) writes into a file handle called $fcf (on a new line) with the senders ip address ($ipaddress) and the time on which they sent their email ($time) in this format: $ipaddress--$time on a new line in $fcf.

I am new to php and if someone could convert my normal language into PHP scripting I would be very grateful.

if ($fcf contains $_SERVER['REMOTE_ADDR'] with time() [giving a time offset anywhere between 0 and 500 seconds ago]) {
[continue the script]

Thanks

(This is the full code:
[PHP]<?php

$subject = $_POST['subject'];
$message = $_POST['message'];
$time = $_SERVER['REQUEST_TIME'];
$ipaddress = $_SERVER['REMOTE_ADDR'];
$fcfdata = "$ipaddress--$time\n";
include 'config.inc.php';
$fcf = fopen($floodcontrolfile, 'a+');
$fcfread = fread($fcf);

//if ($fcf contains $_SERVER['REMOTE_ADDR'] with time() [giving a time offset anywhere between 0 and 500 seconds ago]) {

if ($subject == "") {

echo '
<script language="Javascript">
<!--
alert ("The message contained no subject. Redirecting you to the homepage.")
//-->
</script>
';
echo ' <META HTTP-EQUIV="refresh" CONTENT="2;URL=';
echo $homepage;
echo ' ">';
echo ' <h1> Redirecting... ( Error! No Subject! ) </h1>';
exit();

}

elseif (mail($to, $subject, $message, $headers)) {
fwrite($fcf, $fcfdata);
echo '
<script language="Javascript">
<!--
alert ("Message sent. Redirecting you to the homepage.")
//-->
</script>
';
echo ' <META HTTP-EQUIV="refresh" CONTENT="2;URL=';
echo $homepage;
echo ' ">';
echo ' <h1> Redirecting... ( Sent! ) </h1>';
exit();

} else {

echo '
<script language="Javascript">
<!--
alert ("Error sending message. Redirecting you to the homepage.")
//-->
</script>
';
echo ' <META HTTP-EQUIV="refresh" CONTENT="3;URL=';
echo $homepage;
echo ' ">';
echo ' <h1> Redirecting ( Error Sending Message! Try Again! ) </h1>';
exit();

}[/PHP]

[Atli]

Hi.

Are you only trying to check whether the user with a given IP address has sent anything recently?

If so you should consider some alternate methods. Your method would require you to read through the entire file every time, which will take up more and more resources as the file gets longer.

If you were to use Sessions, you could simply write the current time to the session and then check that field each time before you send an email. You wouldn't even have to save the IP address.

[atyndall]

Are you only trying to check whether the user with a given IP address has sent anything recently?

Yep

If so you should consider some alternate methods. Your method would require you to read through the entire file every time, which will take up more and more resources as the file gets longer.

I was going to add a part that deletes the IP Address/Time once it expires

If you were to use Sessions, you could simply write the current time to the session and then check that field each time before you send an email. You wouldn't even have to save the IP address.

How would I do that?

[Atli]

Sessions are very easy to use. I wrote an article on them, if you want to know the basics.

In your case, you would simply have to check if a session variable exists before you send your email. If it does not, then create it and set it's value to the current time. If it does, make sure that that the time value it contains is older than the time you want to elapse.

That could be accomplished somewhat like this:

// Start session
session_start();
 
// Check the session variable exists
if(isset($_SESSION['LastSent'])) {
  // Check if a post was made in the last 5 seconds
  if($_SESSION['LastSent'] > time() + 5) {
    die("You have already sent a message in the last 5 seconds!");
  }
}
// Set the session variable to the current time
$_SESSION['LastSent'] = time();
 
// Send your mail
// <your code here>
 
 

[pbmods]

Changed thread title to better describe the problem (did you know that threads whose titles do not follow the Posting Guidelines actually get FEWER responses?).

[Weisbartb]

I would recommend using a database to store IP addresses, sessions can easily be lost,destroyed, or changed.
When someone is attempting to send use this.
[PHP]
<?php
$sql = 'SELECT id FROM ips WHERE ip="'.$_SERVER['REMOTE_ADDR'].'" AND lastsent <= UNIX_TIMESTAMP()-500 LIMIT 1';
$res = mysql_query($sql);
if(mysql_num_rows($res) > 0){
//Deny
}else{
//allow
}
?>
[/php]
When its sent use this.
[php]
<?php
//Clean out any old sends. you could do this with select if found update else insert if you want
$sql = 'DELETE FROM ips WHERE ip="'.$_SERVER['REMOTE_ADDR'].'" LIMIT 1';
mysql_query($sql);
$sql = 'INSERT INTO ips VALUES(``,"'.$_SERVER['REMOTE_ADDR'].'",UNIX_TIMESTAMP())';
mysql_query($sql);
?>
[/php]

I recomend a structure of

int id `20` PRIMARY AUTO_INC
varchar ip `15`  PRIMARY
int lastsent `10` PRIMARY

[atyndall]

thanks, ill try and implement that.

[Atli]

I would recommend using a database to store IP addresses, sessions can easily be lost,destroyed, or changed.

Sessions can only be used by the server. So unless you plan on throwing in random session_destroy() calls, your sessions are pretty safe.

Databases are also a pretty good way of doing this, but they do tend to use more resources and they are, in my opinion, not to be used for data that you do not want to keep. That is to say; you should avoid using your databases as a temporary storage, they should used for long-term storage. Especially if there are other, easier, ways to accomplish the same functionality.