Ways to handle query overloading - server attacks?

slick101

Hey everyone.

I started to put some ajax around my site. I use jquery to handle my javascript. What i noticed is if i keep clicking the link my website is all sudden running crazy amount of queries. Is there a way to prevent this?

This also got me thinking about what if the user jsut keeps refreshing his page or i guess if they have a crawler just hitting your website like crazy how do you prevent these attacks?

dagon

attack? sounds like regular use. If every click runs a query then that's what you get. If your site cant handle you hitting refresh how will it handle users?

slick101

Haha, I guess its just that I recently made a ajax link and what I did was i constantly clicked the link like crazy fast and saw the mysql query # on server just went up like crazy. So i was thinking to myself what if a user was being an ass or tryin to overload the server or something?

thanks

dagon

one work mysql server is running an average 237.28 k queries an hour, how fast can you hit refresh :-)

bradgrafelman

dagon's right; if one (or even ten) users can bring down your site using the Refresh button, then you need to stop using a Dell Pentium I computer running Windows 98 for your server. :p

EDIT: Now, if your queries and/or SQL design are unoptimized, then it's possible that they're simply amplifying a mistake on your part. You might consider enabling the slow query log in MySQL and simulate a load on your webserver (Apache comes with tools to do this, if I'm not mistaken) to see if any queries are taking a long time (and by that, I would start by looking for 5 seconds and then 3 or 2).

dalecosp

dagon;10915659 wrote:
one work mysql server is running an average 237.28 k queries an hour, how fast can you hit refresh :-)

Sorry to dredge up an old thread. One here is registering 1394.x per second, which by my calc would be 5M an hour.

Does that sound a little excessive? 😃

(It does to me).

dagon

its not, with out context the numbers are rather meaningless anyway.

dalecosp

Well the problem there is that context is pretty hard to define.

Whose stats do you believe, for starters... The logfiles seem to indicate about 30-50K hits per day on Apache. About 10-15 percent of those are actual page loads; the rest are image loads, script loads, etc. for some other sites. So, say, 5K page loads, or one every 17 seconds or so. By that estimate, one page load is responsible for about 24K DB queries. That seems pretty excessive to me.

Even given that other resources hit the database (ad server, serving some IFrames to other sites), it seems a tad ridiculous.

dagon

dalecosp, i don't really know what statistics your talking about, this is a couple of years old thread you decided to post into. My post #4 was a response to the op being worried that someone pressing f5 could detrimentally effect his site.

dalecosp

Well, I appreciate that you've spent time answering, nonetheless. I'm a bit concerned about a situation relevant to the topic in my work, but didn't think it was worthy of a new thread all to itself.