Flood Control

nubs

I would like to add flood control to here: http://dailyplug.com/linkdump/ but I don't know where to start, can you guys help me out?

vaaaska

Set a cookie with a timestamp on it. If the same person submits twice it will check if the cookie exists and then determine if they have posted in the last 90 seconds or whatever you decide it should be.

Actually, there are a billions ways to do this...so others might come along with completely different approaches. The one above is easy and in the scheme of security is probably ok for you.

nubs

Can you instruct me more.. sorry I'm not that knowledgable 😃

Quadodo

setcookie("lastsubmittime",time(),time()+3600,"/",".dailyplug.com",0);

Put that in the part where they submit it (make sure its with the other header() functions or at the top of the page).

Then check it:

// Number of seconds between plugs
$floodtime=30;
$time=time()-$floodtime;
$lastsubmittime=(isset($_COOKIE['lastsubmittime']) ? $_COOKIE['lastsubmittime'] : '0');
if ($lastsubmittime > $time) {
$timeleft=$lastsubmittime-$time;
die("You can only plug every <b>".$floodtime."</b> seconds, you can plug again in <b>".$timeleft."</b> seconds.");
}

Put that before the plug action 😉

etully

The cookie technique is good enough to block most floods.
If the problem submitters use an automated tool to post links to your page, they won't use cookies so that technique won't work. If that's the case then you might have to use a more sophisticated technique like:

Check to see what URL they are submitting. Check a MySQL table to see if that URL has been submitted in the last X seconds and if so, then don't permit the post.
Find their IP address and check a MySQL table to see if that IP has submitted a post in the last X seconds.
Force people to register for an account before they can post a link, When they post, check that user account to see if they posted a link in the last X seconds.

If you combine all three of those, you will block most problem submitters.

In the really rare event that someone is extremely determined to flood your page, you might need to put up random graphics and have them type in the distorted word before they can post a link.
I have one client who only posts a link if you make a $1 donation to a local charity. This way, the submitter has to type in their Name, Address, and Credit Card info to post a link.

The technique(s) you choose and the amount of time you need to spend building this will depend on how big your flood problem is. For a small site, the cookie solution from vaaaska and Quadodo is probably more than enough.

nubs

etully wrote:
The cookie technique is good enough to block most floods.
If the problem submitters use an automated tool to post links to your page, they won't use cookies so that technique won't work. If that's the case then you might have to use a more sophisticated technique like:

Check to see what URL they are submitting. Check a MySQL table to see if that URL has been submitted in the last X seconds and if so, then don't permit the post.

Find their IP address and check a MySQL table to see if that IP has submitted a post in the last X seconds.

Force people to register for an account before they can post a link, When they post, check that user account to see if they posted a link in the last X seconds.

If you combine all three of those, you will block most problem submitters.

In the really rare event that someone is extremely determined to flood your page, you might need to put up random graphics and have them type in the distorted word before they can post a link.

I have one client who only posts a link if you make a $1 donation to a local charity. This way, the submitter has to type in their Name, Address, and Credit Card info to post a link.

The technique(s) you choose and the amount of time you need to spend building this will depend on how big your flood problem is. For a small site, the cookie solution from vaaaska and Quadodo is probably more than enough.

Yeah, I was trying to make it within the database.. but I was having problems.. I think the cookie will be enough for now. Sence this site is fairly new..