avillanu Posted September 19, 2007 Share Posted September 19, 2007 In my CMS I have a rating program where people can rate each piece of content. Fairly simple to implement - the only problem is that voters can vote multiple times. Anyone know a way to prevent this? Quote Link to comment Share on other sites More sharing options...
LemonInflux Posted September 19, 2007 Share Posted September 19, 2007 flat or MySQL? Quote Link to comment Share on other sites More sharing options...
avillanu Posted September 19, 2007 Author Share Posted September 19, 2007 MySQL Â I forgot to mention: I've done a bit of googling and seen some solutions. But what makes mine a bit more complex is that it's okay for users to vote on multiple pieces of content, just not on the same one. Quote Link to comment Share on other sites More sharing options...
BlueSkyIS Posted September 19, 2007 Share Posted September 19, 2007 you'll have to track votes for each person. i'd use a table of id, person_id, item_id, vote_value. then check to make sure person_id hasn't already voted on item_id before allowing a vote. Quote Link to comment Share on other sites More sharing options...
LemonInflux Posted September 19, 2007 Share Posted September 19, 2007 Or, you create a table called voters, and whenever someone casts a vote, write their name to it. Get the script to check if they're in that table. If they're not, display the poll. Quote Link to comment Share on other sites More sharing options...
avillanu Posted September 19, 2007 Author Share Posted September 19, 2007 ok, would the best way to do this is with IP addresses or is there another way? Quote Link to comment Share on other sites More sharing options...
pocobueno1388 Posted September 19, 2007 Share Posted September 19, 2007 Are the people voting required to be logged into an account? If so, that would make this whole thing easier. If they don't need to be logged in, then you might have some issues with this. You could log IP addresses, but some people have the same one, plus they are always changing...so that wouldn't work very well. Quote Link to comment Share on other sites More sharing options...
Orio Posted September 19, 2007 Share Posted September 19, 2007 I'd say go for cookie + IP. Send each voter a cookie that it if it exists he cant vote again. Also, log the IP and if a same IP votes again dont count it. Another thing you should do- don't display messages like "You can vote more than once" if someone gets blocked by the IP-check or the Cookie-check. Let them think they manged to bypass your security- this way they won't even think or try to improve their "attack" method by blocking cookies using proxies or something like that (at least most of the people). Â Hope this helps, Orio. Quote Link to comment Share on other sites More sharing options...
avillanu Posted September 19, 2007 Author Share Posted September 19, 2007 Wouldn't the IP database eventually get huge if there is one row for every vote? Quote Link to comment Share on other sites More sharing options...
Orio Posted September 19, 2007 Share Posted September 19, 2007 In short, yes. But how many unique votes do you think you will get?? Â Orio. Quote Link to comment Share on other sites More sharing options...
BlueSkyIS Posted September 19, 2007 Share Posted September 19, 2007 Are the people voting required to be logged into an account? If so, that would make this whole thing easier. If they don't need to be logged in, then you might have some issues with this. You could log IP addresses, but some people have the same one, plus they are always changing...so that wouldn't work very well. Quote Link to comment Share on other sites More sharing options...
avillanu Posted September 19, 2007 Author Share Posted September 19, 2007 Well I'll be releasing my script for free, I just want my users to have the easiest time possible. Thanks everyone for the help. Quote Link to comment Share on other sites More sharing options...
cooldude832 Posted September 19, 2007 Share Posted September 19, 2007 I'd say go for cookie + IP. Send each voter a cookie that it if it exists he cant vote again. Also, log the IP and if a same IP votes again dont count it. Another thing you should do- don't display messages like "You can vote more than once" if someone gets blocked by the IP-check or the Cookie-check. Let them think they manged to bypass your security- this way they won't even think or try to improve their "attack" method by blocking cookies using proxies or something like that (at least most of the people).  Hope this helps, Orio.  I'd say that will be a very terrible option on a few reasons. One IP never works because Proxies will get you and you could end up block a person you don't want to block via a pool of ips from an ISP. Secondly Cookies can be deleted. What the best idea is to use a hybrid of cookies/session. Where the session is a short term storage and cookie is long term. I.E if they delete the cookie, the session is still there and remakes the cookie making their vote incastable. However if you have a memeber system i'd suggest just make a 3 column table with ID, UserID, ItemID and on the item say select from table where userid = $_SESSION['userid'] and ItemId = $_GET['itemid'] and if u get a match don't let em vote. that is of course if u have a login system and registration required to vote. Quote Link to comment Share on other sites More sharing options...
avillanu Posted September 19, 2007 Author Share Posted September 19, 2007 Well it's just a rating script for a content site, I don't think anybody would go through the trouble of really going out of their way to find a workaround. Quote Link to comment Share on other sites More sharing options...
cooldude832 Posted September 19, 2007 Share Posted September 19, 2007 its the principle of the thing, if you post how to prevent then expect a prevention method that works, not a half done solution Quote Link to comment Share on other sites More sharing options...
Recommended Posts
Join the conversation
You can post now and register later. If you have an account, sign in now to post with your account.