Question

The following code is within an ajax call. I’m trying to make sure people don’t vote on questions with a certain id too often using sessions.

So they click a button, which executes the following php code:

  $id=$_GET["id"];


if ((isset($_SESSION["$id"]) && ((time() - $_SESSION["$id"]) > 180)) || (!isset($_SESSION["$id"]))) {
    // last vote was more than 3 minutes ago
    $_SESSION["$id"] = time(); // update/create vote time stamp


    //there is code here to add the vote to the database
}
else{
echo "sorry, you've already voted recently";
}

So I’m creating a session variable for each question id which holds the time() of their last vote. I would do this with cookies, but they can be disabled.

Currently, there is a bug somewhere with my logic, because it allows the user to keep clicking the button and adding as many votes as they want.

Can anyone see an error that I have made?

Answer 1

1. using sessions to prevent multiple voting makes very little sense.
2. sessions do use cookies with the same drawbacks
3. unlike strings, variables in PHP should be addressed without quotes. such a false usage WILL cause an error someday.
4. I see no point in checking for isset($_SESSION[$id]) twice.
5. There was a bug in PHP which disallowed numerical indices for the $_SESSION array. Dunno if it was corrected nowadays.
6. As it was pointed out by Sajid, you have to call session_start() before using $_SESSION array.

now to the logic.
to me, it seems the code won’t let anyone to vote at all. as it won’t pass isset($_SESSION[$id]) condition for the first time and won’t let $_SESSION[$id] to be set and so on.

it seems correct condition would be

if ( (!isset($_SESSION['vote'][$id]) OR (time() - $_SESSION['vote'][$id]) > 180) )