jobsonandrew Posted August 30, 2008 Share Posted August 30, 2008 Hi, Im new to PHP (and web development) and I'd like some help with my pet project I have a web page with a form that has a couple of text boxes. I have Apache 2, MySQL and PHP 5 installed and would like to know: What is the best way to identify a user, and prevent that user from submitting the form more than once in 30 mins? Im guessing this will have to be done serverside (so people cant get around it by deleting cookies/changing browsers).. Is this a sessions problem? if so how? I'm having serious trouble understanding sessions.. Ultimatley id like to store and retrieve things from mySQL Thanks Quote Link to comment https://forums.phpfreaks.com/topic/122035-sessions-and-preventing-resubmission-of-a-form/ Share on other sites More sharing options...
.josh Posted August 30, 2008 Share Posted August 30, 2008 Most effective way is to wrap the form around a login. Make the user login and then don't display the form unless it's been 30m since last time. Quote Link to comment https://forums.phpfreaks.com/topic/122035-sessions-and-preventing-resubmission-of-a-form/#findComment-629969 Share on other sites More sharing options...
genericnumber1 Posted August 30, 2008 Share Posted August 30, 2008 It would more be a mysql problem, you could identify the person by ip and place it along with the submission time in a table. You can check the table to see if the person has submitted it in the last 30 minutes. Identifying the person by ip isn't completely effective since ips can change... as the poster above said, a login system is a little bit more reliable, but people can always make 2 accounts. Quote Link to comment https://forums.phpfreaks.com/topic/122035-sessions-and-preventing-resubmission-of-a-form/#findComment-629970 Share on other sites More sharing options...
.josh Posted August 30, 2008 Share Posted August 30, 2008 It would more be a mysql problem, you could identify the person by ip and place it along with the submission time in a table. You can check the table to see if the person has submitted it in the last 30 minutes. tracking it by ip is not effective, as ip's can be easily spoofed or changed. Quote Link to comment https://forums.phpfreaks.com/topic/122035-sessions-and-preventing-resubmission-of-a-form/#findComment-629972 Share on other sites More sharing options...
genericnumber1 Posted August 30, 2008 Share Posted August 30, 2008 It would more be a mysql problem, you could identify the person by ip and place it along with the submission time in a table. You can check the table to see if the person has submitted it in the last 30 minutes. tracking it by ip is not effective, as ip's can be easily spoofed or changed. I just editted that in Quote Link to comment https://forums.phpfreaks.com/topic/122035-sessions-and-preventing-resubmission-of-a-form/#findComment-629973 Share on other sites More sharing options...
jobsonandrew Posted August 30, 2008 Author Share Posted August 30, 2008 yeah IPs were what i thought originally, but a lot of people are also behind proxies etc.. I dont really want something as complicated as a login system.. the page is just for people to leave their name and a comment, like a guestbook or something.. maybe im asking for trouble by having something so simple Thanks Quote Link to comment https://forums.phpfreaks.com/topic/122035-sessions-and-preventing-resubmission-of-a-form/#findComment-629975 Share on other sites More sharing options...
genericnumber1 Posted August 30, 2008 Share Posted August 30, 2008 There's really no way to find out who someone is as ips can be changed, more user accounts can be created, and cookies can be deleted. The best you can do is take all precautions and try to keep in mind that people who really want to, and know how to, will probably be able to exploit it. Quote Link to comment https://forums.phpfreaks.com/topic/122035-sessions-and-preventing-resubmission-of-a-form/#findComment-629977 Share on other sites More sharing options...
jobsonandrew Posted August 30, 2008 Author Share Posted August 30, 2008 how are things like this usually tackled in a real world scenario? i know stuff like this exists.. my clientside cookie thing worked ok until my friend used 6 different browsers and posted 6 times in 2 mins thanks Quote Link to comment https://forums.phpfreaks.com/topic/122035-sessions-and-preventing-resubmission-of-a-form/#findComment-629979 Share on other sites More sharing options...
.josh Posted August 30, 2008 Share Posted August 30, 2008 In the real world it really depends on how important it really is for you to make sure people don't do that. You could make your script track IP and cookie at the same time and that will probably take care of most people not really intending to circumvent it. But if someone does intend to circumvent it, then again, depends on how important it really is to you to keep it from happening. If it's really that important then yes, you're going to have to force a login. Quote Link to comment https://forums.phpfreaks.com/topic/122035-sessions-and-preventing-resubmission-of-a-form/#findComment-629983 Share on other sites More sharing options...
Recommended Posts
Join the conversation
You can post now and register later. If you have an account, sign in now to post with your account.