PHP Server options and voting system

Question

I am currently creating a website that allows anonymous users to input data (or comments) into a database and allows other anonymous users to the site to vote up or down the comments presented on the site.

I have already created the functionality to allow a user to create a comment and allow another user to vote on the comment. The problem I'm having though is thinking how I can limit each visitor to the site to only vote on each comment once.

My idea was to create a session ID when the user votes and then when they try and vote again to try and compare if a session ID already exists. This would work but only until the session is destroyed. Does anyone have any other ideas of how this could be achieved?

I am assuming I might be able to use some of the $_SERVER options available

Thanks in advance

Answer 1

Just restrict the voting with IP's or either Cookies, i also created 3 websites in which i had to take the public voting, earlier i did it with IP's but then i changed back to cookies, i also saved IP's along with setting cookies to check if the users are deleting cookies again and again to vote, but i never had such problem, so my opinion in just go with cookies, because not everyone can find that we are doing it with cookies.

Answer 2

It's impossible to enforce a one-vote policy on an anonymous user system. Like said in a comment above:

Trying to control "Anonymous" is nearly impossible. IP's are shared, sessions are temporary, cookies can be deleted

You can't identify your clients at 100%, if a user would want, he will be able to bypass whatever means you attempt to use and vote more than once.

Your only reliable option is to enforce registration and only allow registered users to vote.

---

If you still insist, you can try to make it difficult for users to bypass your enforcing system. Use a combination of the user's IP address, and a lasting cookie, and cross-validate against both to ensure the user doesn't vote twice. But again, do note that a user can easily delete cookies and on most cases, change his IP address.

Answer 3

When you are inserting comments for specific article, store the member (who is commenting) id or name or any thing unique. Put the verification code before inserting the comments ....

Select * from articles where member_commented_id = [current_member_id_from_querystring) and article_id = member_commented_on_article_id

//a check point
if result is > 0 .. its mean member already has commented on this article

//otherwise
add comments on article and insert member id as well for checking

// if you are using seperate table for comments then you have to make additional field in table like

comment_id, comment, com_date, member_id_who_commented, article_id_on_which_commented

Making IP or Cookies check point is not reliable because IPs are changed by the ISP (if set to dynamic IP) and Cookies can be cleared by visitor

Hope this helps you