Question

I have an html for using POST that is being used to rate images. These images are being selected randomly using SQL.

As soon as I put it up I noticed that some users (identified using a user id) were able to put multiple votes for an image of their choice in short periods of time. It is likely they are exploiting a flaw in the way the http POST is being handled.

As a temporary solution I added some code to check if an image had been rated by the same person in the last hour. This works but isn’t ideal because an image can come up randomly in a shorter span of time.

So, how could I make sure that a single rating is going towards the image being displayed and any consecutive ratings for the same random selection are rejected?

P.S: I might open this up to anonymous users so any suggestions using sessions are also welcome.

Answer 1

Make a compound UNIQUE constraint of user_id and image_id. Then run the query in the format INSERT ... ON DUPLICATE KEY UPDATE.