flood protection

[Phoenix_Down]

On my guestbook I'm trying to add flood protection. I have an idea on how to do it, I just don't know how to make the code.

$Time = "18:11:05";

$Seconds = "60";

$IP = "1.0.0.27";

How do I use the time format above and prevent the poster's IP address from posting again for another 60 seconds.

Thanks so much--I'm still somewhat new at PHP scripting.

[epimeth]

I'm assuming that the guestbook data is being kept in a database...

add a timestamp column to the table... if the current time is within 60 seconds of the database time, reject the post

[Phoenix_Down]

I don't know how to do the code.

[epimeth]

what is the code for adding to the guestbook?

[Phoenix_Down]

It is:

$result = mysql_query("insert into guestbook_entries values ('', '$field1', '$field2', '$field3', '$field4', '$msn', '$aim', '$icq', '$yahoo', '$cusfield1', '$cusfield2', '$cusfield3', '$cusfield4', '$the_date', '$the_time', '$ip')", $dbi);
$result = mysql_query("update guestbook_entries set field1='".$field1."', field2='".$field2."', field3='".$field3."', field4='".$field4."', msn='".$msn."', aim='".$aim."', icq='".$icq."', yahoo='".$yahoo."', cus1='".$cusfield1."', cus2='".$cusfield2."', cus3='".$cusfield3."', cus4='".$cusfield4."', date='".$the_date."', time='".$the_time."', ip='".$ip."' where id='".$entryid."'", $dbi);

Note: $the_date is not the timestamp. I don't know how to add a timestamp to a MySQL query, and when I do, that's when I'll add the timestamp column in my table. 🙂

Thanks for your help, epimeth.

[epimeth]

mysql types include

datetime
timestamp and
time

just add another column, or change the date to a datetime....

[Phoenix_Down]

Okay, I added a timestamp column: 030317102058

My query now looks liks this:

$result = mysql_query("insert into guestbook_entries values ('', '$field1', '$field2', '$field3', '$field4', '$msn', '$aim', '$icq', '$yahoo', '$cusfield1', '$cusfield2', '$cusfield3', '$cusfield4', '$the_date', '$the_time', NOW(), '$ip')", $dbi);
$result = mysql_query("update guestbook_entries set field1='".$field1."', field2='".$field2."', field3='".$field3."', field4='".$field4."', msn='".$msn."', aim='".$aim."', icq='".$icq."', yahoo='".$yahoo."', cus1='".$cusfield1."', cus2='".$cusfield2."', cus3='".$cusfield3."', cus4='".$cusfield4."', date='".$the_date."', time='".$the_time."', timestamp=NOW(), ip='".$ip."' where id='".$entryid."'", $dbi);

[epimeth]

so now you have to

$sql = "SELECT timecolumn FROM guestbook_entries WHERE ipcolumn = $ip";

$times = mysql_query($sql);

while (!($time = mysql_fetch_row($times)){
 if ($time < time() + 60) //not sure how to phrase the if...
  die("<br /><br />You cannot post within 60 seconds of another post<br />Go <a href=\"some/url\">Home</a>");
}

or something like that...

[Phoenix_Down]

So... $time is the timestamp, right? Should I put your code at the beginning of my function, or at the end near the other query?

[Phoenix_Down]

Okay, I put the code before the query and it says 'cannot post within 60 seconds of another post' all the time even if I wait 60 seconds, or 180 seconds. lol

    $sql = "SELECT timestamp FROM guestbook_entries WHERE ip = $ip";

$times = mysql_query($sql);

while (!($time = mysql_fetch_row($times))) {
	if ($time < time() + 60) {
		die("<br /><br />You cannot post within 60 seconds of another post<br />Go <a href=\"some/url\">Home</a>");
	}
}

[xblue]

think about it:
time() + 60
this is going to be in the future, one minute from now.
any existing entry is likely to be posted before that time, right?

the while loop doesn't seem really efficient either, but that shouldn't be your current problem.

start over:

retrieve the maximum timestamp for that user.
something like
SELECT MAX(timestamp) FROM guestbook_entries WHERE ip = '$ip'
I think should work.

compare it to the current time minus 60 second.

[Phoenix_Down]

Hmm, I don't know if this is what you meant but it's still not working:

    // Flood protection

$flood = mysql_query("select MAX(timestamp) from guestbook_entries WHERE ip=$ip", $dbi);

list($the_timestamp) = mysql_fetch_row($flood);

if ($the_timestamp == time() - 60) {
		die("<br /><br />You cannot post within 60 seconds of another post<br />Go <a href=\"some/url\">Home</a>");
}

[hkucsis]

This is not correct

if ($the_timestamp == time() - 60)

Should be

if ($the_timestamp > time() - 60)

[Phoenix_Down]

Thank you, hkucsis, but that didn't solve the problem. Now it's not displaying the error, but posting the entry, even when I flood it.