impose a limitation on form of time duration

Question

crazynp 0 Junior Poster in Training

19 Years Ago

Can anybody help me to build a form where I can put a limitation that if I click on the form once, than I cannot do that again for next 5 minutes.the form has only one fiels that is email address.

php

3 Contributors
7 Replies
120 Views
6 Days Discussion Span
Latest Post 19 Years Ago Latest Post by digital-ether

Dani AI

Generated 9 Months Ago

Good move by to switch to a per-user timer. That is generally stronger than an IP/cookie-only approach (as suggested earlier by and ) when users are authenticated. A few practical hardening points and a safe pattern to avoid edge cases that the current session-only check can still expose.

Use a single server-side timestamp and an atomic database check-and-set so two nearly-simultaneous submissions cannot both pass. Store a last_submit UNIX timestamp (UTC) on the user record rather than a “next allowed” value. With a single conditional UPDATE and checking affected rows, the database enforces the rule atomically:

$now = time();
$timeout = $now - 120; // 2 minutes
$stmt = $pdo->prepare(
  "UPDATE users
     SET last_submit = :now
   WHERE username = :user
     AND (last_submit IS NULL OR last_submit < :timeout)"
);
$stmt->execute([':now'=>$now, ':user'=>$username, ':timeout'=>$timeout]);
if ($stmt->rowCount() === 1) {
  // processed: this request won the race
} else {
  // denied: too soon
}

Other practical notes: use prepared statements (PDO/mysqli) instead of deprecated mysql_* calls; keep times in UTC; log rejected attempts (username, IP, timestamp) for troubleshooting. For higher scale or multi-server setups, put rate-limits into a central store (Redis/memcached) and use atomic INCR+EXPIRE or a token-bucket algorithm. To stop duplicate form-processing from double-clicks, pair the timer with an idempotency token (a unique hidden field per form instance) and mark tokens as used.

Combine defenses based on threat: per-account limits are best for logged-in users; add per-IP limits and CAPTCHA where anonymous/bot abuse is a concern. Return a proper 429 status for automated clients and surface a clear, human-friendly message for legitimate users.

All 7 Replies

php_daemon 3 Junior Poster

19 Years Ago

The easiest way is using database to store the last form submit time by an IP.

Here's the idea:

create table timer(
  ip varchar(255),
  timestamp int
)

$ip=mysql_real_escape_string($_SERVER['REMOTE_ADDR']);
$time=time();
$timeout=time()-5*60;

mysql_query("DELETE FROM timer WHERE timestamp<$time");

$r=mysql_query("SELECT * FROM timer WHERE ip='$ip'");
if(mysql_num_rows($r)>0) 
{
    die("You've already submitted this form in the past 5 minutes");
} else {
    mysql_query("INSERT INTO timer (ip,timestamp) VALUES ('$ip', $time)");
    //process the form
    //.....
}

digital-ether 399 Nearly a Posting Virtuoso

19 Years Ago

The easiest way is using database to store the last form submit time by an IP.

Here's the idea:

create table timer(
  ip varchar(255),
  timestamp int
)

$ip=mysql_real_escape_string($_SERVER['REMOTE_ADDR']);
$time=time();
$timeout=time()-5*60;

mysql_query("DELETE FROM timer WHERE timestamp<$time");

$r=mysql_query("SELECT * FROM timer WHERE ip='$ip'");
if(mysql_num_rows($r)>0) 
{
    die("You've already submitted this form in the past 5 minutes");
} else {
    mysql_query("INSERT INTO timer (ip,timestamp) VALUES ('$ip', $time)");
    //process the form
    //.....
}

You may also want to save a cookie on the users browser with the value of their IP. This way, if the users IP changes, you can still keep track of users on dialup.

so the php part could look like:

$last_ip = isset($_COOKIE['last_ip']) ? mysql_real_escape_string($_COOKIE['last_ip']) : '';

$ip=mysql_real_escape_string($_SERVER['REMOTE_ADDR']);
$time=time();
$timeout=time()-5*60;

//mysql_query("DELETE FROM timer WHERE timestamp<$time");
// i think this should be...
mysql_query("DELETE FROM timer WHERE timestamp<$timeout");

$r=mysql_query("SELECT * FROM timer WHERE ip='$ip' OR ip='$last_ip' LIMIT 1");
if(mysql_num_rows($r)>0) 
{
    die("You've already submitted this form in the past 5 minutes");
} else {
    mysql_query("INSERT INTO timer (ip,timestamp) VALUES ('$ip', $time)");
    //process the form
    //.....
}

// set current IP in case it had changed on the next submit
setcookie("last_ip", $ip);

note: tracking IP and cookies is not foolproof.. some users will still be able to submit multiple times.. but it will stop most..

Reply to this topic

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.

crazynp 0 Junior Poster in Training · Answer 1 · 2007-01-18T00:17:10+00:00

You may also want to save a cookie on the users browser with the value of their IP. This way, if the users IP changes, you can still keep track of users on dialup.
so the php part could look like:
$last_ip = isset($_COOKIE['last_ip']) ? mysql_real_escape_string($_COOKIE['last_ip']) : '';

$ip=mysql_real_escape_string($_SERVER['REMOTE_ADDR']);
$time=time();
$timeout=time()-5*60;

//mysql_query("DELETE FROM timer WHERE timestamp<$time");
// i think this should be...
mysql_query("DELETE FROM timer WHERE timestamp<$timeout");

$r=mysql_query("SELECT * FROM timer WHERE ip='$ip' OR ip='$last_ip' LIMIT 1");
if(mysql_num_rows($r)>0) 
{
    die("You've already submitted this form in the past 5 minutes");
} else {
    mysql_query("INSERT INTO timer (ip,timestamp) VALUES ('$ip', $time)");
    //process the form
    //.....
}

// set current IP in case it had changed on the next submit
setcookie("last_ip", $ip);
note: tracking IP and cookies is not foolproof.. some users will still be able to submit multiple times.. but it will stop most..

Thank you! php_daemon and digita-ether both. I will implement this but what does that mean by "this is not full proof", what should i do it to make it fullproof.
Thanks!

php_daemon 3 Junior Poster · Answer 2 · 2007-01-18T01:30:50+00:00

Thanks for correcting my lil mistake and taking it a step further, digital-ether ;)

Thank you! php_daemon and digita-ether both. I will implement this but what does that mean by "this is not full proof", what should i do it to make it fullproof.
Thanks!

It's not foolproof because the IP can still be changed and the cookie can be deleted.

Making it foolproof is quite a challenge without a user membership present.

crazynp 0 Junior Poster in Training · Answer 3 · 2007-01-22T22:30:57+00:00

Hi,

Now I am using the session with the membership system. The users table has the row call transaction_time for storing the time of the last form processing.

Will you please guide me now.

Here is what I did and it seems to work but I haven't use IP and cookie i just use session. Is this good or insecure?

if ($_POST['process_form'] == 1) {
   if($session->transaction_time < time()){
 
             [B]process form...................[/B]
             $time = time(); 
             $next_time = $time + 2*60; 
             $database->updateUserField($session->username,"transaction_time",$next_time);

    }
   else {
      die("You can only make one transaction in 2 minutes.");
    }
}

Regards!

php_daemon 3 Junior Poster · Answer 4 · 2007-01-23T03:32:12+00:00

Hi,
Now I am using the session with the membership system. The users table has the row call transaction_time for storing the time of the last form processing.
Will you please guide me now.
Here is what I did and it seems to work but I haven't use IP and cookie i just use session. Is this good or insecure?
if ($_POST['process_form'] == 1) {
   if($session->transaction_time < time()){
 
             [B]process form...................[/B]
             $time = time(); 
             $next_time = $time + 2*60; 
             $database->updateUserField($session->username,"transaction_time",$next_time);

    }
   else {
      die("You can only make one transaction in 2 minutes.");
    }
}
Regards!

Yes, you're setting the timer for a specific user, it's a secure enough way to ensure the timer is not avoided.

digital-ether 399 Nearly a Posting Virtuoso Team Colleague · Answer 5 · 2007-01-23T11:20:05+00:00

Hi,
Now I am using the session with the membership system. The users table has the row call transaction_time for storing the time of the last form processing.
Will you please guide me now.
Here is what I did and it seems to work but I haven't use IP and cookie i just use session. Is this good or insecure?
if ($_POST['process_form'] == 1) {
   if($session->transaction_time < time()){
 
             [B]process form...................[/B]
             $time = time(); 
             $next_time = $time + 2*60; 
             $database->updateUserField($session->username,"transaction_time",$next_time);

    }
   else {
      die("You can only make one transaction in 2 minutes.");
    }
}
Regards!

That is a good way.
You could also use the IP address and a cookie like described before with the "user session" based system you're using now...

It really depends on what you are trying to achieve (Why you are limiting sending the form).

In different scenarios you would use different things...

If you are trying to stop bot based spamming of some service on your website such as a forum, then this may not be enough. The reason is that a spammer can log in as a different user and spam the forum.
(Logging into your forum can take a very short time if the user is a bot, even less than 1 second..., thus spam around 100 messages in 2 minutes ).
For this, you would be better using a CAPTCHA, which is an image that bots find hard to read, but people see instantly. (captcha's are not foolproof also, but the reasoning behind them is that it takes too much processing power on a computer to read multiple captchas when spamming).
Its also good to log IPs when using CAPTCHAs, as bots that are smart enough to read the captcha can be figured out if their IP pops up more than once withing the time limit you set. (Cookies are useless on bots, they will usually ignore it or set some fake value).

If you are trying to avoid spam from actual users and not bots, like when users are logged into a forum and repost twice (sometimes without knowing) then the solution works fine, as by the time the user logs out and re-login as someone else, 2 minutes would have gone past.
So you would use the session based system you currently use for this scenario.

Just thinking about it, I think I should probably list a few methods you can use, and others can add to the list...

1) Session / User based restriction
2) IP based restriction
3) Cookie based challenge-response
4) Captcha based challenge-response
5) SSL connection
6) Confirmation page challenge-response

"Session / User based restriction" is what you're using.
"IP based restriction", "Cookie based challenge-response" and "Captcha based challenge-response" was mentioned before...

And SSL connection makes sure the server is sending information to who requested it.

"Confirmation page challenge-response" is when the sever sends back a confirmation page after the form is submitted. The confirmation page will contain a form, with a hidden field with a unique value for that form submission (Usually a md5 or sha1 hash).
This makes sure the response from the server reaches the client (and thus was generated from that client) and also slows down bots.
This is more effective used with SSL.

impose a limitation on form of time duration

Dani AI

Recommended Answers Collapse Answers

All 7 Replies

Recommended Answers