dont' use sessions those can be lost, too easily.
you want three bits of info
the ip address used, the time of the first hit, and the number of hits since
ip_address | first_hit_time | hit_count
then every time a whois is executed you
1) get current time
2) find a matching ip address in the table, if one doesn't exist, create it and set the first_hit time to current time
3) if the first_hit was more than 5 minutes ago, set hit_count to 1
4) if the first_hit was less than 5 min ago, increment the hit_count
5) if the hit count is above your abuse threshhold, do not execute the query
6) if the hit count is below your abuse threshhold, do the whois
7) run a cleaning program that runs every so ofter and removes all entries older than 5 minutes,
or
7) give a X% chance on every whois query of running a cleaning operation to remove all 5 minute old requests
so now you are left up to figuring out:
how to run your cron table clean up
how to connect and make table entries, remove table rows, update hit_times, deduce time differences
does that make sense?
happy coding
[edit]
most of those second set of problems can be found by simple reading up on the documentation of whatever database engine you use, both postges and mysql have searchable docs online.
