Question

So let’s say I created a feedback form in C#.
It sens the feedback to my PHP Page and my PHP Page adds it to my MySQL Database.
Code:

private void PostFeed(string Params)
{
    using (WebClient wc = new WebClient())
    {
        wc.Headers[HttpRequestHeader.ContentType] = "application/x-www-form-urlencoded";
        wc.Headers["Accept"] = @"text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8";
        wc.Headers["Accept-Language"] = @"en-US,en;q=0.5";
        string HtmlResult = wc.UploadString("http://website/feedtest.php", "POST", Params);
        Console.WriteLine(HtmlResult);
    }
}

On my PHP I have a code that looks similar to:

$name = $_REQUEST['name'];
$email = $_REQUEST['email'];
$desc = $_REQUEST['description'];
connect
post result...
close connection

The question I have is: is there a way to protect against flood ? I understand anyone can just spam/flood it by sending feedback continuously or even creating a third party app that sends like 1000 post request per second. I was thinking of implementing some sort of check on the PHP side, for example: if the connection password from the c# app matches, then continue if not, exit.

Basically, I dont want people to take advantage of the feedback method and spam me.

Can anyone suggest a method ? or Should I not even worry about this ?
Any help is appreciated.

Answer 1

A typical technique is to have some kind of submissions per X unit of time limit where you have a last_submitted_at column in a table associated with some kind of identifier. For example, you might associate it with a user if you have a fairly robust user registration system, or you might associate it with an IP if you don’t.

This is the system that Stack Overflow uses if you try and vote, post, or as questions too often. Each of these has a separate timer which probably translates to a separate last_X_at column in the database somewhere.

If the last time is less than some threshold, present an error instead of accepting the submission.