[Resolved] Prevent Flooding

DeadlySin3

I would like to prevent a user from posting more then 1 message in a time period of 30 seconds.

Heres how i'm trying to do it:

<?php
$ip = getenv("REMOTE_ADDR"); // Obtaining IP Addy

$hourdiff = "-2"; // Local Time difference from Server Time
$timeadjust = ($hourdiff * 60 * 60);
$todaysdate = date("l, F d Y h:i a",time() + $timeadjust);

// Example of $todaysdate
// echo "$todaysdate";
// returns Tuesday, September 09 2003 10:00 pm

include("dbCnx.inc"); // DB Info

$dbQuery = mysql_connect($server,$user,$password);
mysql_select_db ($db) or die ("Cannot connect to database");
/* Connected to server and selected db unless you got error */

$floodQuery = "SELECT `tagitdate` , `tagitip` FROM `tagit` WHERE `tagitip` = '$ip'";
$flooding = mysql_query($floodQuery); // Add Error checking 
while($f=mysql_fetch_array($flooding))
{

$tagitdate=$f['tagitdate'];
$tagitip=$f['tagitip'];

if(($ip == $tagitip) && ($tagitdate <= $todaysdate - time() + 30))
{
$floodMsg = "You're flooding. Wait to Post";
echo "$floodMsg";
die(); 
}

// I'm thinking the IF statement above is wrong..
// I've tried doing this quite a few different ways
// Usually I end up with a constant $floodMsg showing
// Or no $floodMsg showing at all. Ideas? Suggestions?
// Any help is greatly appreciated!

} // End While Loop
?>

[notes]
$tagitip is the exact same as $ip - different variable name and $tagitip is what's stored in the database.

$tagitdate is the exact same as $todaysdate - different variable name and $tagitdate is what's stored in the database.
[/notes]

If you need more information than this please let me know!
🙁

majiclab

It seems that you are trying to compare two dates as strings. This might work if the strings were in this format:

YYYY-mm-dd HH:mm:ss

However you have them in a format such as:

Monday, January 1 2003 12:34 PM

You don't even have seconds in there...

You could use the strtotime() function in PHP, however, you could just also modify your query a bit, you could add a WHERE statement where it only selects the row if the tagitdate is more than 30 seconds old...

eg:

SELECT * FROM tagit WHERE tagitip = '$ip' AND tagitdate > (NOW() - INTERVAL 30 SECOND)

That would pull any tagit row where the ip is the same and the tagitdate is less than 30 seconds old. If there is a row that matches that criteria, they are trying to flood...

This will only work if your tagitdate field is a TIMESTAMP field or a DATETIME field. You can't just store a date as a string in the database...

Hope that helps.

-Percy

DeadlySin3

Percy,

Thank you kindly for your reply!

I wrote that code last night at around 3 in the a.m - I was tired and I KNEW something was wrong w/it! Just couldn't pin point what...

I'm going to modify my table and try to use your example; i'll letcha know the outcome!! Thanks again!

DeadlySin3

o.O

I owe you one, Percy.. that worked like a charm!!

I ended up making a new row on the table tagit - calling it tagitflood. I stored now() in there, and used this select statement

<?php
SELECT * FROM tagit WHERE tagitip = '$ip' AND tagitflood > (NOW() - INTERVAL 30 SECOND)
?>

Now, if I wanted to make '30 SECOND' a variable, could I go about it like this

<?php
$floodTime = "30";
SELECT * FROM tagit WHERE tagitip = '$ip' AND tagitflood > (NOW() - INTERVAL '". $floodTime . "' SECOND)
?>

I don't see why I couldn't... but asking never hurts. I would try it but it's already getting late & i gotta head to bed.. gotta work earlyyy tomorrow.

Thanks!

majiclab

That definitely would work, in fact, it is a good idea!!

-Percy