如何防止用户在一小时内投票多次？
目前我有一个带有验证码的脚本，该脚本在提交时记录用户的 IP 地址，以防止用户每小时投票多次。
然而，许多人正在使用代理来绕过这一投票限制，我想采用额外的保护。
我意识到关于这个主题还有其他问题，但它们总是涉及人们希望用户只能投票一次，而不是定时限制。
感谢您的任何帮助
编辑：我不想强迫用户登录
At the moment I have a script with CAPTCHA, which on submit logs the users IP address to prevent a user from voting more than once per hour.
However, many people are using proxies to get around this vote restriction and I would like to employ additional protection.
I realize there are other questions about this topic, but they always involve people wanting users to only be able to vote once, rather than a timed restriction.
Thank you for any help
EDIT: I do not want to force users to login
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（5）
没有 100% 安全的方法可以避免人们每小时投票超过一次，但这里有一些方法可以让用户更难规避它：
There is no 100% secure way of avoiding people to vote more than once an hour, but here are few methods to make it harder for the users to circumvent it:
您可以使用cookie，但人们可以删除它们。最简单的答案，而不强迫他们登录（如果他们有多个电子邮件等，他们可以创建多个帐户），如果他们无法以某种方式偷偷绕过它，就很难限制他们。
You could use cookies, but people can delete them. Simplest answer without forcing them to login (for which they can create more than one account if they have multiple Emails etc) it would be hard to limit them without them being able to sneak round it somehow.
服务器上带有 IP 地址的内存表
evercookie
浏览器指纹识别
需要注册
每小时清除一次表格的 cron 作业
http://code.google.com/p/mailvalidator/
制作禁止域列表
访问 10minutemail 并复制电子邮件域并添加到清单
MEMORY tables on server with ip addresses
evercookie
browser fingerprinting
required registration
cron job to clear tables once a hour
http://code.google.com/p/mailvalidator/
make list of banned domains
visit 10minutemail and copy e-mail domain and add to the list
您是否反对让用户在您的网站上注册才能投票？我想说的是基于帐户，而不是IP。许多用户可能位于 NAT 后面，这将为他们分配相同的外部 IP（例如工作或学校）。在这种情况下，我想说一个包含四列的表就足够了：用户 ID、投票 ID、投票时间、选择。如果存在相同的用户 ID/投票 ID 组合，并且时间比现在减一小时，则不允许他们投票
Are you against having users register on your site in order to vote? I would say make it based on account, not IP. Many users can be behind a NAT which would assign them all the same external IP (think work or school). In this case I'd say a table with four columns would suffice: user id, poll id, vote time, choice. If the same user id/poll id combination exists and time is greater than now minus one hour don't allow them to vote
如果“坏”人足够聪明，可以使用代理投票反对您的意愿或规则，那么他们也很可能能够规避其他保护措施......
但您可以执行以下操作：
1）设置投票后在机器上建立 cookie，但用户可以手动删除 cookie
2) 强制用户帐户投票，通过电子邮件地址验证，但用户可以创建备用用户帐户
2bis) 用户帐户只能获得投票权24 小时后，可能不适合您的应用
3) 与堆栈溢出一样，在用户帐户上实现信誉机制，以便他们只有在证明自己不仅仅是机器人或替代身份后才能投票
If the "bad" people are clever enough to use proxies to vote against your will, or the rules, chances are that they will be able to circumvent other protections, too...
But here are the things you can do:
1) Set up a cookie on the machine after the vote, but users could remove the cookie manually
2) Enforce user accounts to vote, validated by an email address, but users could create alternate user accounts
2bis) A user account could get the right to vote only after 24h, might not be suitable for your app
3) Like stack overflow, implements a reputation mechanism on user accounts so they will be able to vote only after having proved they're not just bots or alternate identities