投票系统中的唯一IP
我正在为我的 PHP/MySQL 网站创建一个投票系统，我想确保一个用户只能投票一次。这样做的好方法是什么？到目前为止，我已经想到并半实现了以下内容：
使用 IP 和投票将个人选票存储在数据库中。这会造成体积庞大，但确保每个用户都获得一票。
在用户端存储 cookie 以检查他们是否投票。这是最简单的，但显然用户可以禁用 cookie。
最实用的方法是什么？任何其他建议都非常受欢迎。
I'm creating a voting system for my PHP/MySQL website and I would like to make sure one user can only vote once. What would be a good way of doing this? So far I have thought of and semi-implemented the following:
Storing individual votes in the database with an IP and vote. This creates bulkiness but ensures that each user gets one vote.
Storing a cookie on the user's end to check if they've voted or not. This is the most simple but obviously users can just disable cookies.
What would be the most practical approach? Any other suggestions are more than welcome.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（7）
无法获得的完美：（唯一的政府编号）
足够接近现实：（电子邮件/第 3 方身份验证）
想法虽好但虚假（IP 地址）
The Crash-And-Burn (Cookies)
The Unobtainably-Perfect: (Unique Govt Number)
The Close-Enough-For-Reality: (Email/3rd Party Auth)
The Good-Thought-But-False-Pretense (IP addresses)
The Crash-And-Burn (Cookies)
如果您想有机会审计您的系统，您应该在数据库中存储尽可能多的信息。如果您记录很多，那么即使存在投票欺诈，您也可能能够检测到并取消这些投票。
第二种方法是完全不安全的。如果用户想再次投票，只需删除 cookie，您将无法检测到这种情况已经发生。
重要说明
IP 地址与人员之间不存在一对一的映射。有些人拥有多个 IP 地址，而另一些人则共享一个 IP 地址。
You should store as much information as you can in a database if you want to have any chance of auditing your system. If you log a lot, then even if there has been voting fraud you might be able to detect it and cancel those votes.
The second method is completely insecure. Users can just delete the cookie if they want to vote again and you will have no way to detect that this has happened.
Important note
There is not a one-to-one mapping between IP addresses an people. Some people have many IP addresses, whilst other people share a single IP address.
完全可靠的方法将会很棘手。您的两种想法都有问题 - cookie 可以被禁用，并且一个用户可能拥有多个 IP 和/或许多用户可能共享相同的 IP。强制用户注册并只允许每个注册帐户投一票会更好，但随后有人可能会注册多个帐户。对每个帐户强制进行唯一的电子邮件验证会在一定程度上减少这种情况，但您仍然可以通过注册多个不同的电子邮件来绕过它。
基本上，你采取的每一项措施都会让出行变得更加困难，但同时也会增加投票的难度。如果没有将选票与可验证的已知唯一信息（SSN、护照号码）联系起来，您采取的任何措施都可以被规避，这只是取决于付出的努力。除了其他措施之外，手动审查可疑选票也有助于减少欺诈选票。在易用性和安全性之间划定界限实际上取决于您，具体取决于您需要在多大程度上强制执行一票限制。
A fully reliable way is going to be tricky. Both your ideas have problems - cookies can be disabled, and one user may have many IP's and/or many users may share the same IP. Forcing your users to register and only allowing one vote per registered account would be better, but then someone might signup for multiple accounts. Forcing unique email verification for each account reduces this somewhat, but you could still get around it by signing up for multiple different emails.
Basically, each measure you take makes it more difficult to get around, but also increases the effort of voting at all in the first place. Short of tying votes to something known unique (SSN, passport number) that can be verified, any measure you put in place can be circumvented, it just depends on how much effort it is. Manually reviewing suspicious looking votes would help to reduce fraudulent votes too though, in addition to other measures. Where you drawn the line between ease-of-use and security is up to you really, depending on how much you need to enforce the one vote limit.
正如 Mark Byers 所说，某些国家/地区可能拥有动态 IP 地址（例如越南），因此每次用户建立连接（或重置调制解调器）时，IP 地址都会不断变化。但如果您能确保您的系统构建在 IP 地址静态的国家/地区，那就没问题了。
cookie 解决方案似乎有点不安全，但如果您的大多数用户都是非技术人员，那么他们将无法识别其中的技巧（即删除 cookie 并再次投票）。对我来说，我不喜欢这种方式，因为我知道我的用户对这种技术一无所知。
我建议您在投票时进行
邮箱验证，这样结果会更加准确。用户可能只有几个电子邮件地址，并且他们不想创建新电子邮件地址只是为了投票。As Mark Byers said, some countries might have dynamic IP addresses (e.g. Vietnam) so the IP addresses will consistently change every time a user establishes a connection (or reset the modem). But if you can ensure that your system is built in a country where IP addresses are static, then it's fine.
The cookies solution seems to be a bit insecure, but if most of your users are non-tech people then they won't be able to recognize the trick (which is to delete the cookies and vote again). For me I don't prefer this way as long as I know my users don't know anything about this technique.
I suggest you to have
email verificationfor the poll, so that the results will be more accurate. A user might only have a few email addresses, and they don't want to create new ones just to vote.无论您决定使用什么，IP 地址都根本不安全。用户基本上可以从不同的位置访问并再次投票等。Cookie 是一种解决方案，但由于删除的可能性而未进行优化（因此您会冒用户识别过程的风险）。您将需要处理来自用户的更多数据，以便能够安全地记录他们的选项。
如果系统是一个更大系统的子系统，也许您可以使用更大系统中常见的字段来识别当前系统中的用户。
希望这有帮助，
Whatever it is you decide to go with, IP addresses will not be secure at all. A user can basically access from a different location and vote again etc. Cookie is a solution but not optimized because of deleting possibility (so u risk the user recognition process). You will need to handle more data from the user to be able record their option securely.
if the system is a sub-system of a bigger system, maybe you can use a field that is common in bigger system to identify users in current system.
Hope this helps,
确保用户只投票一次的唯一方法是创建用户帐户 因为：
Cookie 可以被删除
IP 地址是可以更改的。 （此外，多个用户可以拥有一个 IP 地址）
The only way to make sure users vote only once is to create user accounts Because:
Cookies can be erased
IP address are meant to change. (also, multiple users could have one IP address)
这很好，但比第二慢，但我仍然推荐这个。
你是对的，它不安全，但速度更快，但我不喜欢这个
That is Good but slow than 2nd but still i recommend this.
you're right its insecure but little faster but i don't like this