针对未登录的用户存储数据？

Question

On my website users do not log in, yet they can interact with the site. For example, they can vote on categories.

What would be the best way to prevent a user (even though they are not logged in) from voting for the same category more than once.

My initial thought was to store a user's IP address, when they vote, their IP along with the category voted for is stored in my database. Voting again for the same category will not have any effect.

I know proxies etc can circumnavigate this, but it's only meant to be a casual system to fool basic users.

Is there a better way to do this?

Answer 1

You can start a session with session_start() and use AJAX to store vote information in the session. Similarly you can use AJAX call to your PHP script to see if a user can vote or not.

One downside to that is that if user removes his PHPSESSID cookie your session_start() will create new session, to avoid that you should use your own session control, any way you like, though it would have to store more unique information such as user-agent and the IP address as well as PHPSESSID.

Note, without any heavy counter-measures this can be fooled, one way or another, but you said yourself it's only meant to be a casual system to fool basic users.