Double posting in user-made comment system *FIX*

[NiXXeD]

I've seen forum posts in just about any place with people requesting a way to help with preventing double posting on any sort of commenting/forum/messageboard etc... Well, I just implemented a way on my site and it's working perfectly. If you just simple throw a hidden input with the value being a timestamp of the current time. When you receive the POST data, just use the hidden input value for the time that the user posted the comment. But before you make a database insert (or whatever you use), just check to see if any posts contain that exact timestamp. Chances are it's not going to happen at the exact same second as someone else (maybe even check userid/name too?), so there should be no problems. I realize that this might make a difference if a user just opens the page and lets it sit forever, and then comes back, but how often will that happen, and what would it really matter? Anyway, just thought I'd share and see what everyone thought.

NiX

[JDcrack]

While that may sound like a good idea, and would probably work on small to medium sized forums, I really don't believe that it is a sound system, and is certainly not fool proof, and I could actually foresee major problems with it.

Originally posted by NiXXeD
Chances are it's not going to happen at the exact same second as someone else

This is a very bad thought process, and I don't think anyone should ever implement iffy code because 'chances are it won't happen'. This is extremely poor planning.

When engineers build a bridge, they don't say, "Well, the bridge could collapse if scenario 'A' happens, but chances are scenario 'A' won't happen.

Well, what happens when scenario 'A' does happen?
When you write code, you should always take the approach, that scenario 'A' WILL happen, and eliminate the chance.

Originally posted by NiXXeD
I realize that this might make a difference if a user just opens the page and lets it sit forever, and then comes back, but how often will that happen, and what would it really matter?

Again, we have scenario 'B', and this programmer taking the lazy approach of 'it probably won't happen, and if it does, so what?'
If you ever find yourself saying that about a solution....
think again, because it's not a solution.
Why not think of other ways to solve the problem, where a chance of both scenario A & B don't exist?

I do not apologize to any persons who may have been offended by this post.

I see more and more shortcuts and sloppy coding every day, and sometimes it seems as though this 'It probably won't happen' attitude is permeating just about every Public programming forum, and it sickens me.

I am not saying my code is perfect, far from it, but I am learning more every day. When I start a project I work very hard to never have that attitude, and I work even harder to find solutions that actually work.

[matjaz]

instead of timestamp put some long unique value to the field and thats it. you have 1:10000000000000000 chances to find 2 same values. a lot 🙂

works perfectly!

i have always been wondering about quality of programmers who add "only press once" next to the submit button...

[NiXXeD]

Well it was like 2 in the morning when I wrote that... And I just thought through stuff as I was writing it and I wasnt about to go fix things... But... I gotta get to work anyway..

[NiXXeD]

I never said that you had to limit your code to what I said considering it was mostly just theory (but I used it on my site), and I had already planned on implementing a userid check with the timestamp check, so that the only way the code would error (which shouldn't happen period) is if someone with the EXACT SAME userid (not possible) posts at the EXACT SAME time, therefor making any error situation impossible. I was just really tired when I wrote that post...

I could make a timeout that checks to see how long the user sat on the page before posting, and have it expire at a certain time, but I don't want to have to make my pages expire like that.

Generating a random number? How would I go about using that effectively? I wouldn't want to just have another field in each row for the random number. That would take up more space that isn't even really being used. And as for the bridge example.

As for my bridge collapsing, the most error the script could produce is causing the user to have to press a button one extra time, and that doesn't even matter, because I've fixed the possibility anyway. That's not exactly a bridge collapsing either, although I understand your point. I have made several adjustments to the code on my site on NUMEROUS occasions based on things that are likely to NEVER happen even ONCE, but I did so because I'd rather have the security to know that even if they did happen, it wouldn't matter.

If you don't think my 'bridge' is stable enough though, give me an alternate solution that doesn't make the user redirect through other pages (I hate those kind), and will work even if the user presses back and resubmits the POST information.

Anyway - </addingtothefire>

[jerdo]

I don't know JD I personally like crappy programming skills, for a couple of reasons:
1) Sometimes it's just fun to laugh at ignorance.
2) Makes me feel more secure in my job seeing so many people out there with such poor "skills".
But mostly just number one for a little while then I quickly start hoping I never have to take over a project from someone who lacks the ability to think before saying a program is flawless (which if you say something is flawless you most likely aren't thinking at all).

[Saruman]

Hey, guys, but if you want just to check for a double post - why do you need this time checks and random numbers? I've used a more simple solution and it shows a good results. When a some user posts his message, I takes his previous message and compares them in any way (for example, direct string comparision or any hash functions). If this comparision indicates that this messages are similar - I rejects the new one. That's all and that works. You may also apply some time checks if you want to permit same posts in the some period (for example, every day) - this may be useful for some kinds of boards.

[Frag]

There are alot of ways you can do it. You could also create a sequence id table. When the form loads it creates a new sequence and assigns it to a hidden field. When they submit the form for the post it will insert that sequence into the message table. In the message table you just setup a field that is unique and not null.

Sure you can get sequences that don't exsist in the message table, but thats ok because all it's used for is to prevent dupe posts. The only way to get a dupe post is to recreate the same post and repost it. As pressing back won't change the sequence id hidden in the form and reject it upon re-submitting.

Frag