带会话的 PHP 投票系统？
我一直在 stackoverflow 上阅读有关用 PHP 创建投票系统的信息，以最大限度地减少同一用户的滥用/多次投票，但我还没有找到我的问题的答案。
我有一个应用程序，用户不需要注册即可投票或“喜欢”条目。显然，我希望最大限度地减少滥用，并且不想限制每个 IP 地址的投票，因为某些组织（包括我的组织）使用共享 IP 地址。
我以前从未在未经身份验证的系统中使用过会话，但由于此应用程序以入场投票为中心（用于纯粹的娱乐价值，但我仍然想最大程度地减少滥用），我想知道这种方法是否有效以及是否可行存在任何缺点，例如性能影响，以及是否可以以这种方式使用会话：
- 加载网站时启动会话
- 每个会话允许每个项目一票
如果这是一个坏主意，我的替代选择是允许每个 IP 地址的合理投票数（例如 25），或者对同一 IP 地址的投票之间设置时间限制。
你们有什么推荐/您认为什么对用户来说是最烦人的？重新启动浏览器、投票之间等待 5 分钟或清除 cookie？
I've been reading up on stackoverflow about creating voting systems in PHP that minimize abuse/multiple voting from the same user, but I haven't come across the answer to my question.
I've got an application where users don't need to register to vote or "like" an entry. Obviously, I want to minimize abuse and I don't want to limit votes per IP address because some organisations (mine included) use shared IP addresses.
I've never used sessions in a non-authenticated system before, but since this application is centered around entry votes (used for purely entertainment value, but I'd still like to minimize abuse) I was wondering if this approach would work and whether there were any disadvantages such as performance implications, and whether it's even possible to use sessions in this way:
- start a session when the website is loaded
- allow one vote per item per session
If this is a bad idea, my alternative options would be to allow a reasonable number of votes per IP address (say 25), or put a time limit between votes from the same IP address.
What do you guys recommend/what do you think would be most annoying for a user? Restarting a browser, waiting 5 minutes between votes or clearing cookies?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（4）
如果没有用户身份验证，确实没有办法建立一个“严肃的”投票系统，所有其他选项都有缺陷：
There is really no way to make a "serious" voting system without user authentication, all other options have flaws:
仅会话是个坏主意，因为如果您关闭浏览器并再次访问，您将能够投票。您可以使用会话作为“帮助”。最好的选择是使用 ip 限制。您也可以使用cookies，但它又只是一个“帮手”，因为您可以清除浏览器中的cookies。
我建议你像你说的那样使用ip限制，一个ip可以投票25次，并使用cookies来限制一台电脑投票超过一次。因此，如果用户想要投票多次，他可以删除 cookie，但他不能投票超过 25 次。
Only session is bad idea, because if you close the browser and come again you will be able to vote. You can use session as "help". The best option is to use ip limiting. Also you can use cookies, but it is again just a "helper", because you can clean cookies from browser.
I suggest you use ip limiting like you said, one ip can vote 25 times and use cookies to limit a computer from voting more than once. So if a user want to vote more than one time, he can delete a cookie, but he won't be able to vote more than 25 times.
我同意坎普的观点，饼干是最好的选择。此外，会话还使用 cookie - 不同之处在于会话 cookie 在浏览器关闭时被删除，“简单”cookie - 当它过期时，在这种情况下“更好”。
如果谈论IP地址，用户可以使用代理来绕过“IP过滤”。
投票结束后，有人可能会检查结果以查看是否有任何可疑之处（例如 5 分钟内来自单个 IP 的 100 票） - 这将有助于获得更真实的结果。
I agree with kemp that cookies is the best choice. Furthermore, sessions also use cookies - the difference is that session cookie is deleted when browser is closed, "simple" cookie - when it expires, which is "better" in this case.
If talking about IP addresses, users can use proxies to bypass "IP filtering".
When voting finishes, someone might go through results to see if there's anything suspicious (like 100 votes from single IP in 5 minutes) - that would help getting more truthful results.
您可以同时使用 cookie 和 apc/memcached 等服务器缓存机制。使用相同的密钥/cookie 名称将投票结果存储在 cookie 和 apc 缓存中，并检查两者是否存在。如果 cookie 被删除但 apc 密钥仍然存在，那么您就知道有人正在尝试重新投票，您可以重置 cookie 并增加 apc 缓存值的生命周期。
它不是防弹的，但在没有数据库的情况下，我认为这是一个很好的解决方案。请记住，如果服务器耗尽 RAM，它将刷新 apc 缓存。
You could use both cookies and a server cache mechanism like apc/memcached. Store vote results in the cookie and in the apc cache using the same key / cookie name, and check for the existence of both. If the cookie is deleted but the apc key still exists then you know someone is attempting to re-vote, and you could just reset the cookie and increase the lifetime of the apc cache value.
It's not bullet proof, but in the absence of a database i think it's a good solution. Keep in mind that if the server runs out of ram it will flush the apc cache.