Even after adding antifloor some people being able to post same stuff again.

[$php_mysql$]

friends whats wrong with this piece of code that one user on my site spams the same thing over and over tho i have added flood control for 6hours but he posts right after posting one. i have tested myself it works for me but why not for that user?

 

        if($_SESSION['last_session_request'] > time() - 21600){
    		        header("location: antiflood.php?post=wait");
    		        exit;
		}	
		$_SESSION['last_session_request'] = time();		

[ManiacDan]

Because  the user clears their session cookie after posting and/or is using a bot.

[$php_mysql$]

do you have any piece of code better than this one?

[jcbones]

Check the database for the users last post time.  That is going to be the most fail proof way.

[$php_mysql$]

ok u mean while storing the data i even store their session in a row and use that session? can you please guide me to some simple examples?

 

thanks soo much

[jcbones]

No, I suppose (as most forums, chatboxes, or reply post do) you store a user_id to the post as well as the time posted.

 

<?php
$sql = "SELECT COUNT(id) FROM forum WHERE user_id = $current_user AND '00:00:30' > TIMEDIFF(NOW(),`timestamp_column`)"; //30 second control.
$result = mysql_query($sql) or die(mysql_error());
if(mysql_num_rows($result) > 0) {
exit(' You can only post 1 time per minute.');
}

[$php_mysql$]

oh in my case i do not have registered users there is no login or register on my site its just come and post. how can i implant it for that?

[jcbones]

Store a form token, and a timestamp.

 

May I suggest the 5th link.

 

 

[redarrow]

 

add a captcha that slow them down

 

http://www.codewalkers.com/c/a/Miscellaneous/Creating-a-CAPTCHA-with-PHP/

 

 

go all the way and only allow registered users use your website.

[scootstah]

Without requiring users to be registered, you are kind of out of luck. You could use a cookie, but they can just delete it. You could use their IP, but they could just change it. You could require an email, but they can just use a different one. You could use a captcha, but they can be bypassed.