Security question???

arelgee

I am proud to say I got my db up and php script running. Now I am worried about some idiot going to my site and entering my stock picking contest a thousand times.
I have a simple form that asks for a name and five stock picks.
On submit, it adds the entries to the db and shows the entries so far.
Should I use the date() function and allow only one entry every five minutes or so? The total limit of entries is 25 chars for the name and 12 each for 5 picks.
to keep someone from using the back button and submitting the same form over and over, I though of checking each entry with the last one made. But this could be gotten around by using two different entries.
Checking each entry against the entire db sounds silly.
Any info from someone already having done this would be appreciated.
arelgee aka larry grant

jstarkey

arelgee, are you worried about duplicate entrys, as in someone entering the contest many times? Your subject mentions security, so I'm a bit confused.

If you're worried about DoS, someone would have to be a pretty quick clicker to cause a DoS with the back button.

As for submitting the same form over and over: when you posted this thread, you were taken to an intermediary page and then redirected back to your thread. This is how vBulletin clears the post or get variables so that you can't refresh and cause duplicates.

mikeatrpi

You could log their IP, or use their IP and a timestamp to check how often they try to enter. But IP's aren't terribly reliable and are easily spoofed. If you wanted to get intense, you could make some sort of email membership system and only accept entries from folks who reply to their email, only once per day, per email address, per hour... In short, you can't really stop someone from entering 1000 times; only impede them. Just make sure you don't make it too hard for your intended audience to enter.

arelgee

Many thanx. Both of you brought up good points.
Eventually, I will have content for subscribers only and will go with the email verification, password, member id, etc.
But this is just a gimmick to draw in interested parties, there are no prizes or anything other than bragging rights at stake. But I don't want someone entering 25 times with different names and picks and winning the contest by default. I also don't want my hosting folks sending me nasty e-mails for bringing down the server.
I think I will add an email address to the entry. I will simply log it in the database and use it to verify the winners. Both of you seem to suggest that if I make it too difficult to enter, no one will be interested. It is so easy to set up email accounts that no one should object to this. I am carelful about my email addresses to keep off the spam lists.
I have seen scripts that verify email addresses, I think without actually having to send an email to them. I will check that out.
arelgee at are-l-gee.com

arelgee

Did anyone catch the third posting on this thread? This is exactly what I am talking about.
I even have a section on my site about ponzi scheme posting on messageboards.
I guess it takes all kinds.
arelgee