每个 IP 地址限制 1 票？
我真正想要的是限制每人 1 票，但我能想到的下一个最好的事情是限制每个 IP 地址 1 票，以防止恶意用户/黑客严重篡改我公司的投票系统。 我正在考虑使用数据库来跟踪 IP 地址。
更新： 抱歉第一次没说清楚。 我想知道限制每个 IP 地址 1 票是否是限制每人 1 票的好策略。 基本上，我想知道 1 个唯一的 IP 地址是否大致等于 1 个人。 人们已经提到代理和路由器重复使用 IP 地址，因此不幸的是，许多人可以使用相同的 IP 地址。
谢谢。 我认为，就我而言，最好不要限制每个 IP 地址 1 票。
What I really want is to limit 1 vote per person but the next best thing i can think of is limit 1 vote per IP address to prevent malicious users/hackers from severely tempering with my company's voting system. I was thinking of using a database to keep track of the IP addresses.
Update:
Sorry about not being clear in the first time aruond. What i wanted to know if limiting 1 vote per IP address was a good strategy to limiting 1 vote per person. Basically, i wanted to know if 1 unique IP address is roughly equal to 1 person. People have already mentioned that proxies and routers re-use ip addresses so unfortunately, many people can be using the same ip address.
Thanks. I think, for my case, it'll be best to NOT limit 1 vote per ip address.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（7）
我建议不要采用 IP 方法。 当我之前看到这一点时，一些大型 ISP 经常重复使用 IP（AOL...），但如果您确实使用 IP 地址，请使用数据库来跟踪它们。 一种快速的方法是使其成为唯一的键，并将异常捕获为“已投票”。
需要添加的一件好事是不要向用户表明他们的投票没有被计算在内，而只是显示结果，或者感谢他们的投票。 如果不给出特定的错误，就会变得更加困难，有时甚至不会被有问题的用户注意到。
I would suggest not going with the IP approach. When I looked at this before some of your large ISPs reuse IPs a lot (AOL...), but if you do use IP addresses, use a database to track them. A fast way to do it is to make it a unique key and to catch the exception as "already voted".
One good thing to add is not to show a user that their vote was not counted, just show the results, or thank them for voting. By not giving that specific error, it is harder and sometimes not even noticed by your problem users.
如果您使用 IP 地址，那么您将限制大多数公司只能投一票，因为它们通过防火墙或代理服务器路由所有出站互联网流量。 我们几年前就这样做过，发现所有 AOL 流量仅来自 5 个 IP 地址。
If you use IP addresses then you'll be limiting most companies to only one vote because they route all outbound internet traffic through a firewall or proxy server. We did this a couple of years ago and found that all AOL traffic came from only 5 ip addresses.
一般来说，是的，您要做的就是拥有一个用于投票的数据库表，并简单地存储选择+IP 地址 - 然后在插入时，执行数据库查询以查看是否已存在具有给定 IP 的条目。
理想的解决方案是将投票与用户帐户联系起来，而用户帐户又与更具体的存在（例如信用卡、手机或其他不易增加的身份来源）相关联。
您到底要问什么问题？
Generally, yes, what you would do is have a database table for the votes, and simply store choice+ip address - then when inserting, do a DB query to see if an entry already exists with the given IP.
The ideal solution would be to tie votes to user accounts which are in turn linked to more concrete presence (such as a credit card, cell phone, or other less-easily-multiplied identity source).
What exactly is the question you're asking?
我一直这样做的方法是将用户代理和 IP 地址连接到 MD5 哈希值中（在某些情况下，这将允许来自同一 IP 的人投票，只要他们使用不同的浏览器），并将其存储为“指纹”用于对数据库进行投票并为其添加唯一密钥。 正如 IPX Ares 所说，从那里你可以捕获重复密钥异常，你应该很好。
如果您想允许人们每天投票一次，您还可以将 Ymd 附加到该“指纹”或其他变体，以允许每小时 x 次投票或每天 x 次投票。
The way I have always done it is to concat the user agent and ip address into an MD5 hash (in some cases this will allow people from the same IP to vote, long as they are using different browsers), and store that as a "fingerprint" for the vote the the database and add a unique key to it. As IPX Ares said, from there you can catch the duplicate key exception, and you should be good.
If you wanted to allow people to vote once a day, you could also append the Ymd to that "fingerprint", or other variations to allow x amount an hour or x amount per day.
是的，使用数据库。 不要依赖 cookie，它们可以轻松删除。
IMO，到目前为止，基于 IP 的投票限制是最好的选择。
Yes, use database. Don't rely on cookies, they can be easily deleted.
IMO, so far, IP based voiting limitation is the best option.
正如我们在上面所指出的，IP 地址有其局限性，但浏览器还有许多其他特征可以阻止恶作剧的选民。 例如，几乎每个浏览器的 BrowserID 都是不同的。 您可以使用 BrowserID 和 IP 地址的组合来创建唯一的 ID。
IP address has its limitations as we have noted from above, but there are many other characteristics a browser has which can damper mischeivious voters. BrowserID, for example, is different for just about every browser. You could use a combination of BrowserID and IP address to create a unique ID.
“帮助”避免作弊的另一种方法是在表单中提供一次性使用的哈希值，然后在计票之前检查该哈希值是否有效。
例如：
当您创建投票表单时，您会创建一个随机散列并将其存储在数据库中，并将其作为
隐藏放入表单中场地。（可能想向哈希数据库添加一个日期字段，以便清理未使用的哈希值）
然后，当您收到投票
POST请求时，您可以检查提供的哈希是否有效存在于数据库中并将其从数据库中删除，这样就无法再次使用。缺点：
如果投票页面流量较高，可能会以较高的 IO 负载数据库。
无法将页面缓存为计划 html，因此它会给网络应用程序带来更大的压力。
Another way to 'help' avoid cheating is to provide a 1 time use hash into the form then check if that's is valid before you count the vote.
For example:
When you create the voting form you make a random hash and store it in the database and put it in the
formas ahiddenfield.(might want to add a date field to the hash database to you can clean up the unused hashes)
Then when you get a vote
POSTrequest you can check if the supplied hash is in the database and remove it from the database so it cant be used again.CONS:
Might load the database with high IO if the voting page has high traffic.
Can't cache the page as plan html so it puts more stress on the web app.