Or, if not, then yes, session should be the way to go. Also note that using the above, someone could literally change the URL (either in the HTML or after the refresh) to a new number (say 10). Thus essentially "hacking" your system.
Sessions would be the safer way to go. You'd want to start a session, define when they reached that page (as in a timestamp), define a maximum grace period (like 10 minutes, one hour, one day) that they can get 10 refreshes in, then define the count:
<?php
session_start(); // Start the session
if(!isset($_SESSION['time_in']) || !isset($_SESSION['refreshed']) || !isset($_SESSION['expires_in']))
{
$_SESSION['time_in'] = time(); // Set this to a unix timestamp
$_SESSION['refreshed'] = 0; // Haven't refreshed yet...
$_SESSION['expires_in'] = 60*60*30; // 1/2 an hour in seconds
}
else if (time() > $_SESSION['time_in'] + $_SESSION['expires_in'])
{
$_SESSION['time_in'] = time(); // Set this to a unix timestamp
$_SESSION['refreshed'] = 0; // Haven't refreshed yet...
$_SESSION['expires_in'] = 60*60*30; // 1/2 an hour in seconds
}
else
{
// So they're within the time period.... now we just need to count the refreshes
$_SESSION['refreshed']++;
}
?>
Now, that should properly set up you session to count the refreshes, whether manually or by <meta> tag.
Later in your script, you'd just make sure that the current time is within the constraints, and that the $_SESSION['refreshed'] value is equal to 10:
if(time() <= $_SESSION['time_in']+$_SESSION['expires_in'] && $_SESSION['refreshed'] >= 10)
{
die('<h2>AH!!</h2><p>You\'ve refreshed this waaaaaaaaaaaaaay too often!!</p>');
}
Hope that helps.
