PHP International times form security

session variable and validation

[scriptmasterdel]

Hi to all,

I have placed a simple code on my site to check weather the user has sent a message i the last five minutes and if they have then the form can not be sent untill the time has obviously gotten past the time limit (shown below)

<?php
if(isset($_SESSION['last_message_time_sent']))
{
# user can only send a message every ... minutes
$can_send_message_every=5;
# get the time now ;)
$time_now=date('Hi');
# make the waiting period
$limitation_time=$time_now-$can_send_message_every;
if($limitation_time<$_SESSION['last_message_time_sent'])
{
$err[] = 'You can not send another message this soon';
}
}
?>

And once the form is sent successfully the variable above is set (shown below)

<?php
$_SESSION['last_message_time_sent']=date('Hi');
?>

My Question is:- Will this cause a problem with international time differences? ... Or will this cause a problem once the clock ticks twelve and then the roles are reversed of the variables?

If so should i add a date validation to this script to insure that doesn't happen?

Please help

Thank you to all that do!

Del

[barns101]

The time is taken from your server clock, so international visitors will not be a problem. However, when the clock goes past Midnight you could have problems because your script could return a negative number (if I'm understanding it correctly).

I would use a Unix timestamp instead, generated by $time_now=mktime(); 5 minutes is 300 seconds, and so subtracting that from a timestamp will be more reliable.

[Habtom]

Timestamp hehe timestamp. You never know what can go wrong. . . go for the smallest extent, use timestamp.

[scriptmasterdel]

Thank you, i will read up a bit more about the "mktime" function, i was curious about when the clock goes past Midnight issue.

What other ways are there for protecting my site from automated spamming?

I use a a free GPL software called "freecap" it's usefull against capcha software as it protects in so many different ways and can be changed to suit each site i create.

I also use a function in my e-mail sent to check for more than one @ symbols in the to from and message.

Is there much more i can do to protect my website frin spamming automation?

Del