PHP or Javascript - How do you set a minimum time between form submits

Question

Surprisingly, I couldn't find anything relevant on the internet/stackoverflow, while I would think it's often used.

My form is basically a file upload form, and I want to set a minimum time between form submits using Javascript or PHP (PHP prefered), to protect the form from bots etc.

The only thing I could came up with was a cookie/session, but those can be deleted/cleared/modified.

Answer 1

In the end, I used a simple MySQLi table.

The MySQLi table contained three columns,

1. 'ID' (the User's Login ID),
2. TimesUploaded (Times uploaded within a specified, default 15, amount of minutes),
3. TimeLastUploaded (The time the user uploaded its first of the maximum, TimesUploaded, documents)

The Code:

1.Function getuploaduse()

function getuploaduse(){
    require('connect.php'); //Connect with the MySQL database
    $theid = mysqli_fetch_array(mysqli_query($link, "SELECT COUNT(*) FROM `UploadUse` WHERE ID=\"".$_SESSION['id']."\""));
    if($theid[0] == 0){
        return 'makenew'; //Make a new row
    } else {
        return mysqli_fetch_array(mysqli_query($link, "SELECT TimesUploaded,TimeLastUploaded FROM `UploadUse` WHERE ID=\"".$_SESSION['id']."\"")); //Pass on TimesUploaded and TimeLastUploaded
    }
}

2.PHP in Upload Page

//Set variables
$block = 'false';
$mintime = 15; //A minimum of 15 minutes between $maxuploads
$maxuploads = 3;
$contents = getuploaduse();// [0] => TimesUploaded, [1] => TimeLastUploaded


if(isset($_POST['thetitle'])){ //If users uploads

if($contents != 'makenew'){
    if($contents[0] == $maxuploads){
        $block = (time() - $contents[1]);
        if($block < ($mintime * 60)){
            $block= 'false';
            mysqli_query($link, "UPDATE `UploadUse` SET `TimesUploaded`=1,`TimeLastUploaded`='".time()."' WHERE `ID`='".$_SESSION['id']."'"); //Reset
        } else {
            $block = $mintime - round($block / 60);
        }
    } else {
        $block = (time() - $contents[1]);
        if($block >= ($mintime * 60)){
            $block= 'false';
            mysqli_query($link, "UPDATE `UploadUse` SET `TimesUploaded`=1,`TimeLastUploaded`='".time()."' WHERE `ID`='".$_SESSION['id']."'"); //Reset
        } else {

            $increased = ($contents[0] + 1);
            mysqli_query($link, "UPDATE `UploadUse` SET `TimesUploaded`='".$increased."' WHERE `ID`='".$_SESSION['id']."'"); //Increase
            if($increased == $maxuploads){
                $block = $mintime - round($block / 60);
            } else {
                $block = 'false';
            }
        }
    }
} else {
    mysqli_query($link, "INSERT INTO UploadUse(ID,TimesUploaded,TimeLastUploaded)   VALUES('".$_SESSION['id']."','1','".time()."')");
}

//Place your upload script here and set $success to something to show your success and not the 'Maximum uploaded'

}

//Block if user doesn't upload (so when he tries to access the upload page)

if($contents != 'makenew' && $block == 'false'){
$contents = getuploaduse();// [0] => TimesUploaded, [1] => TimeLastUploaded
if($contents[0] == $maxuploads){
    $block = (time() - $contents[1]);
    if($block < ($mintime * 60)){
        $block = $mintime - round($block / 60);
    } else {
        $block = 'false';
    }
}
} 

3.With your uploadform

<? if($block == 'false'): ?>
<!-- Your upload form here -->
<?php elseif(isset($success)): ?>
<!-- Success here-->
<?php else: ?>
<div class="alert alert-block alert-danger fade in">
    <h4>You exceeded the maximum uploads per <?php echo $mintime; ?> min.</h4>
    <p>You may upload maximum <?php echo $maxuploads ?> documents per <?php echo $mintime; ?> minutes. You have to wait for <span class="label label-danger"><span id="updatemin"><?php echo $block; ?></span> minute<? if($block > 1){echo 's';} ?></span>.</p><br />        
  </div>
<? endif; ?>

4.In my HTML Header (So when the users is blocked, it will update the minutes remaining)

<?php if($block != 'false'):?><meta HTTP-EQUIV="REFRESH" content="60; url=/Upload"><? endif; ?>

If you think this code is useful, please vote my (own) answer up, as I did spend time on this code. (I'm a beginner, and to me, this code is something to be proud of, especially since I haven't used tutorials or other answers)

Answer 2

storing the submitter ip you can use:

• memcache key which expires after minimum time
• temp file "flag"
• make life harder for the bot using captcha