Protecting Submission Form from Flooding

[mmarkin]

Hello everyone;

I am working on a submission form and have finished the script but have not yet implemented any security features that would protect the form from being flooded. I would like to hear what techniques you use to accomplish such a task.

I do not want to rely on IP-logging alone because that might block legitimate users sharing the same external IP on a LAN. I thought of adding some kind of unique ID to each request. Are there any totally unique variables I can use in PHP to distinguish users? I dont want to use cookies; I want this to be totally server-side.

Any ideas?

Thanks a lot.

Mikhail

[sk8Krog]

use cookies. They would be put on the person's machine that submited something and others in the same LAN could still use it.

[dlowe93]

Originally posted by sk8Krog
use cookies. They would be put on the person's machine that submited something and others in the same LAN could still use it.

Better yet, use a local shared object. Not server side, but better than a cookie.

d.

[mmarkin]

Hmm... the thing is, such a cookie has to last up to a month. I was thinking of something more like a MAC address type of thing.

[dlowe93]

Originally posted by mmarkin
Hmm... the thing is, such a cookie has to last up to a month. I was thinking of something more like a MAC address type of thing.

Use a local shared object combined with a date object and you're done.

d.

[defuzz]

if you were desperate you could check the users IP address and only allow one submission from each IP.

If you're worried that people on networks who share IP's might have problems you could always allow just a certain number form each IP, poeple might still be able to send more than one but you could still restrict them to only x number of submissions.

I'd have thought cookies would be the easiest way though.

[mmarkin]

The problem with cookies is that most users clear their data every once in a while; cookies usually dont sit around for an entire month.

[defuzz]

they may well erase their cookies but its unlikely they'll keep erasing their cookies just so they can resubmit the form.

On the other hand if its for a competition or soemthing and you really want to restrict EVERYONE to ONLY one submission then maybe IPs would be the answer.

[mmarkin]

That is more like what I want to do; Its a survey. I am also aiming at protecting people of extracting the required variables from the page source and using those to submit thousands of fake results.

[defuzz]

you can use this PHP code to access a user's IP:

$variable_name = $GLOBALS['REMOTE_ADDR'];

[mmarkin]

Yes, I am aware of that...

[mmarkin]

Hi.

I am thinking out a security system for a form submission script. I was wondering if I should let the user know that their repeated submissions are not being accepted or if I should just say "thank you" and let them think that they're flooding my database. What do you guys do? What do you think should I do? I am very curious.

Thanks.

Mikhail

[JabezStone]

Mikhail,

I merged your new thread with this one you started last week, since it is still the same topic. Just keeping the Board clean.. thanks!

[mmarkin]

Sorry about that.... I thought it would be better to keep it separate when I opened it...

Mikhail

[Musicman]

Hi.

IP checking is quite unfair to those who use dynamic ip connections
Many people who are used to clear their cookies would not even know how to clear their local shared objects
In order to prevent extracting data from the form, you could use a flash form with a one-time mangling function

Musicman

[mmarkin]

Alright. Can anyone steer me in the right direction with those local shared objects? This is pretty much the first time I hear about those things.

Thanks.

Mikhail

[dlowe93]

Originally posted by mmarkin
Alright. Can anyone steer me in the right direction with those local shared objects? This is pretty much the first time I hear about those things.

Thanks.

Mikhail

Explanation here:

http://www.macromedia.com/support/fl...shared_object/

Tutorial w/source files here:

http://www.macromedia.com/support/fl...s/local_so.htm

It requires the Flash 6 player, but in my opinion it so much easier and reliable than using cookies.

d.

[mmarkin]

Thanks a bunch. I was hoping for something "standard", but I will take a good look at those.

Thanks again.

Mikhail

[dlowe93]

Originally posted by mmarkin
Thanks a bunch. I was hoping for something "standard", but I will take a good look at those.

Thanks again.

Mikhail

What do you mean by "standard"? I've done quite a bit with local SOs so feel free to email me if you have any questions.

d.

[mmarkin]

I meant no Flash - standard HTML/Server-side scripting.

Mikhail