Problem With Script - when SELECTING from database for logged and non logged in users

[ilya Kraft]

Hi,

Right, I've recently added Like/Dislike system to my website. One of the features is recording voters ip address, so he can't vote more than 1 time. But Now I tried to change system so it checks if user is logged in, and if he is than information from database is filtered by username instead of ip, but for non logged in users it is filtered by ip like before. I tried to achieve this task, but for some reason it is not working correctly (Showing same data for all logged and non logged in users)

Here is the full code of the system, It is quiet big... but I will BOLD and UNDERLINE the area/s where, I think, problem could be. (I will comment code in important parts)

 
<?php
include("pulse.config.php"); //Contains Database Connection info
class Pulse {
    private $style;
    private $votes_table;
    private $format = "%7Bup%7D+upvotes%2C+%7Bdown%7D+downvotes";
 
    function __construct($style=''){ 
        $this->style = empty($style) ? 'thumb1' : $style;
        $this->votes_table = 'pulse_votes';
    }
 
    function setFormat($tpl) {
        $this->format = urlencode($tpl);
    }
 
    public static function css(){
        return "<link rel='stylesheet' href='".PULSE_DIR."/assets/css/pulse.css'></link>";
    }
 
    public static function javascript(){
        return "<script type=\"text/javascript\" src='http://inelmo.com/js/jquery-1.6.js'></script>\n<script type=\"text/javascript\" src='".PULSE_DIR."/assets/js/pulse.core.js'></script>";
    }
 
    public function votedBefore($story_id){
 
        if($_COOKIE['pulse_item_'.$story_id] == 1) { 
            return true;
        } else {
 
        $queryData = "";
        $userName = $_SESSION['username']; //Collects Username from another script on the page (not here)
        $ip = $_SERVER['REMOTE_ADDR'];   //Collects users ip address 
 
        if(isset($_SESSION['username']) && $_SESSION['username'] != ""){ //If user is loged in, so has username and that username is not empty
        $queryData = '("SELECT * FROM {$this->votes_table} WHERE `username` = ' . $username . ' AND `item_id` = $story_id")'; //Filter data by username
        } else { //If user is not logged in, so has no username
        $queryData = '("SELECT * FROM {$this->votes_table} WHERE `ip` = ' . $ip . ' AND `item_id` = $story_id")'; //Filter data by ip address
        }
 
            $query = $queryData;
            $result = mysql_query($query);
            if(mysql_num_rows($result)>0){ 
                return true;
            } elseif(mysql_num_rows($result)==0){ 
                return false;
            }
        }
    }
 
    public function countUpVotes($story_id) {
        $query = "SELECT * FROM {$this->votes_table} WHERE `item_id`= $story_id AND `vote_value`>0";
        $result = mysql_query($query);
        $votes = 0;
        while($row = mysql_fetch_assoc($result)){
            $votes+=$row['vote_value'];
        }
        return (int) $votes;
    }
 
    public function countDownVotes($story_id) {
        $query = "SELECT * FROM {$this->votes_table} WHERE `item_id`= $story_id AND `vote_value`<0";
        $result = mysql_query($query);
        $votes = 0;
        while($row = mysql_fetch_assoc($result)){
            $votes+=$row['vote_value'];
        }
        return (int) -$votes; 
    }
 
    private function createButtons($story_id){
        if($this->votedBefore($story_id)==true){
            $html = <<<EOD
<span class='pulse_vote_buttons'>
<input value='lol' type='button' class='pulse_vote_button vote_up disabled' data-dir='up' data-itemId='$story_id' data-format='$this->format' disabled='disabled'><input value='lol' type='button' class='pulse_vote_button vote_down disabled' data-dir='down' data-itemId='$story_id' data-format='$this->format' disabled='disabled'>
</span>
EOD;
        return $html;
        } else {
        $html = <<<EOD
<span class='pulse_vote_buttons'>
<input value='lol' type='button' class='pulse_vote_button vote_up' data-dir='up' data-itemId='$story_id' data-format='$this->format'/><input value='lol' type='button' class='pulse_vote_button vote_down' data-dir='down' data-itemId='$story_id' data-format='$this->format'>
</span>
EOD;
        return $html;
        }
    }
 
    public function getFormatted($story_id, $format) { 
        $upVotes = $this->countUpVotes($story_id);
        $downVotes = $this->countDownVotes($story_id);
        $balance = $upVotes - $downVotes;
        $result = preg_replace('/{up}/',$upVotes, urldecode($format));
        $result = preg_replace('/{down}/', $downVotes, $result);
        $result = preg_replace('/{balance}/',$balance, $result);
        return $result;
    }
 
    public function voteHTML($story_id) {
        $html = "<div class='pulse_votes_container $this->style'>\n".$this->createButtons($story_id)."\n<span class='pulse_result_format'>".$this->getFormatted($story_id, $this->format)."</span>\n</div>";
        return $html;
    }
 
    public function voteUp($story_id){
        if(!$this->votedBefore($story_id)){ 
            $ip = $_SERVER['REMOTE_ADDR'];
            $voter_username = $_SESSION['username'];
            $query = "INSERT INTO {$this->votes_table} (`item_id`, `vote_value`, `ip`, `username`) VALUES ($story_id, 1, '$ip', '$voter_username')";
            $result = mysql_query($query);
            if(mysql_affected_rows()==1){ 
                return true;
            } else { 
                return false;
            }
        }
    }
 
    public function voteDown($story_id){
        if(!$this->votedBefore($story_id)){
            $ip = $_SERVER['REMOTE_ADDR'];
            $voter_username = $_SESSION['username'];
            $query = "INSERT INTO {$this->votes_table} (`item_id`, `vote_value`, `ip`, `username`) VALUES ($story_id, -1, '$ip', '$voter_username')";
            $result = mysql_query($query);
            if(mysql_affected_rows()==1){ 
                return true;
            } else { 
                return false;
            }
        }
    }
}
?>
 
 

[dlite922]

simply debug your votedBefore function.

Put a die('in if') in the if part and put die('in else') in the else section. Test it in the browser. Do you always get the else part?

Is session var 'username' correct? Did you forget to create your session by calling session_start() in this page?

do a die(var_dump($_SESSION))

That gives you all your variables. See if username is in there.

Also, I wouldn't use 'username' as a good key. Think about when the user logs out? do you still want to know who it is? no if you reset this, that means I could vote once with my username and once more with my IP :)

IP can be changed easily, see google("proxy"), so I can vote many many times.

I would use IP, Session Cookie, and as many other things as possible.

This is one reason why sites don't let you vote unless you've signed up with an account. (see Facebook's "like" feautre and reddit.com or digg.com's up vote and digg features)

Good luck,

Dan