Question

I have set up a polling system on my website. However to ensure that people cannot vote again, I have a IP finding mechanism to gather their IP and to make sure that they do not vote again.

The way in which i do this, is I gather their IP then compare it to a text file which has the IP in it. It has a comma to separate each IP.

function getUserIP()
{
//check ip from share internet
if (!empty($_SERVER['HTTP_CLIENT_IP']))
{
  $ip=$_SERVER['HTTP_CLIENT_IP'];
}
//to check ip is pass from proxy
elseif (!empty($_SERVER['HTTP_X_FORWARDED_FOR']))
{
  $ip=$_SERVER['HTTP_X_FORWARDED_FOR'];
}
else
{
  $ip=$_SERVER['REMOTE_ADDR'];
}
return $ip;
}

$visitorIp = getUserIP();
$myFile = "ip_polllist.txt";
$fh = fopen($myFile, 'r');
$theData = fread($fh, 200);
fclose($fh);
$findme = $visitorIp.",";
$mystring = $theData;
echo $mystring;
echo $findme;
$pos = strpos($mystring, $findme);
if($pos === true)
{
    die();
}
if($pos == true)
{
die();
}

What is wrong with the code and why does $pos = false?

Answer 1

I don’t think your approach is really good:

1) It is not really good to write to a single file from multiple requests, because the looking of the file might decrease the performance of your script. Don’t you have access to any database system?

2) Do you have any account system on your page? If yes, I would prefer to restrict a second vote based on the account rather than on the IP address.

3) What do you do when you start a second poll? Create a second file?

4) fread($fh, 200): What happens if you have 100 locked users (IPs)? Your script only reads the first 200 bytes.

5) if($pos == true): I really don’t like relying on the autocasting “feature” of PHP. You are expecting FALSE or a number so check for FALSE and >= 0.