如何确保用户只能在24小时内投票一次

Question

I am building a feature that allows a user to vote only once in every 24 hours.

Here is my database structure

 id ip        timestamp           userid
  9 127.0.0.1 2013-06-27 16:52:49 35

I used this function to get the user client up address, i am in localhost environment and it keep giving me localhost ip 127.0.0.1 instead of my public ip. Is there anything wrong with it?

function get_client_ip() {
    $ipaddress = '';
    if (getenv('HTTP_CLIENT_IP'))
        $ipaddress = getenv('HTTP_CLIENT_IP');
    else if(getenv('HTTP_X_FORWARDED_FOR'))
        $ipaddress = getenv('HTTP_X_FORWARDED_FOR');
    else if(getenv('HTTP_X_FORWARDED'))
        $ipaddress = getenv('HTTP_X_FORWARDED');
    else if(getenv('HTTP_FORWARDED_FOR'))
        $ipaddress = getenv('HTTP_FORWARDED_FOR');
    else if(getenv('HTTP_FORWARDED'))
        $ipaddress = getenv('HTTP_FORWARDED');
    else if(getenv('REMOTE_ADDR'))
        $ipaddress = getenv('REMOTE_ADDR');
    else
        $ipaddress = 'UNKNOWN';

    return $ipaddress;
}

Is there something wrong my logic for this feature, my idea is

1) first query tabel to see if ip for the user is persisted. If so, he/she voted 2) Check timestamp of vote against current timestamp, if his voting time is way before 24 hours, then allow him to vote again.

My concern is not with the timestamp, but with the ipaddress. I do not know if the function i built is good enough to get his ipaddress, even if he is behind proxy.

Advices appreciated. thanks

Cheers

Answer 1

Why you don't set a cookie? You set a 24h expiring time. I know thats not 100% secure but I can easily reconnect to internet to change my ip so ip check is "insecure" too.

if $_COOKIE["alreadyVoted"] throw new Exception(...)

http://php.net/manual/en/features.cookies.php

http://www.php.net/manual/en/function.setcookie.php

Hope this helps.