Re: voting script

Apathy wrote: > What I want to do is have a system that stops people from voting on each > section more than once (i.e. cheating). The only easy way to eliminate cheating is to log the ip-addresses :( This will create huge logs (Although I don't consider 15 bytes per users much. With 100,000 users this will be 1.5 MB, but if you get that many visitors, you will be able to afford this amount of webspace) Requiring their e-mail address (and ask them to verify their vote or to email them a password) would be even better, but it makes voting more work and is a huge invasion of the visitors privacy. I will not give you my e-mail address just to be able to vote for something relatively unimportant. So It will cost you a lot of votes (I estimate 75% or more). So unless the users allready have accounts I don't think this is an option. (And it will create even bigger log files.) Cookies is an option you should forget immediatly. 1) you can't guarantee a cookie is supported or accepted by the clients browser. 2) People who want to cheat can very easily cheat. An easy option to protect yourself against cheating would be to keep the users IP address in a log for one hour (or one day, or ....) This will limit the amount of votes to 24 per day if the users really wants to cheat (and he has to know he can vote again after one hour) but will keep your log file small. The problem of many people sharing the same IP address (as mentioned in some of the other replys) has nothing to do with firewalls, but is a problem of routers (in combination with IP masquerading). A firewall, a router and a proxy are three entirely different and seperate things, but people often think they are one and the same. I myself am using a router, and only recently added a firewall to it, but I am not running a proxy. The percentage of companys and private persons using a router is very small, I would not worry about this. If you do want to let more than one user per IP being able to vote, you'll have to use a e-mail or account approach (which will probably cost you more votes than you would gain). You could also tell a user to type a certain (random) number when they vote. This makes voting more work and thus less easy to do 100 times. This allows voting multiple times, but I don't think there is anyone who will spend hours of typing just to vote 100 times ("type this numer in the input field: 59475923 and enter your vote below"). A normal user will have to type those numbers over and over to cheat, but a programmer will be able to write a simple program to do this for him and will be able to cheat :( This option is easier to make than the IP logger, doesn't have the 'router problem' and doesn't require a log file, but with a bit of work cheating is possible. (Large scale cheating will require some programming skills.) I don't advise this one but it is an easy one to make... Remember. 1 user cheating can ruin the complete poll. Better have 100 people not being able to vote than 1 person being able to cheat. I would go for the IP logging option. Roland Witvoet P.S. Sorry for that previous post.