creating a poll and preventing multiple submissions

[ChrisE]

I'm working on a pretty simple polling system right now, and I have a general question about preventing someone from filling out the form multiple times within a given time period while at the same time encouraging people to fill out the poll.

I'm concerned that asking for some kind of log in or email address might be too invasive and would prevent people from filling out the form.

Things I've come up with include logging the IP address and storing that as well as setting a cookie with an identifier. Then each form submission can be double checked.

Are there any other methods anyone can suggest?

[CyBerAliEn]

You are on a good track.

There really aren't any other options available (besides requiring a login, etc).

If you *really* want to prevent people from voting multiple times, the best solution (without requiring extra effort from your user) would be to setup a database table to log poll voting, with values such as: when (timestamp), ip address. [and any other cols you need for tracking, such as maybe a poll id if you have multiple polls running, etc]

Each time someone votes... query the database for their IP, sorted by timestamp descending with a limit of 1 (low DB usage). You can even have the DB do the work of checking if there is entries for the visitor (user) within your "window" (when timestamps are/not allowed, using WHERE statement). You can quickly determine: (a) has this person voted before; and (b) if yes, how long ago? (this checks by IP address)

You can do the same thing with PHP SESSIONS (my suggestion over straight-up cookies)... storing the timestamp of their last vote (and for which poll). Then when someone votes (or you display the poll), you can quickly check if the user has voted yet (and prevent new voting). This will save the info on the person's session (via a PHP created cookie to identify the user)... would not rely on IP address --- a good/simple solution.

Obviously there are issues with both setups:
(1) If the person's IP changes, they can vote again. If another person happens to have an IP of someone who already voted, they will not be able to vote [despite not having actually voted].
(2) Some users clear/empty their cookies/history after every browsing session, meaning that when they come back later... they may be free to voting again.

If the above issues are HUGE issues... you're only solution would be to require a user account and login. And even then, your user account system would need to be robust enough to detect/reject duplicate user accounts. Then, you can track poll voting by the user (instead of IP).

I would not recommend having a check for both IP and some special cookie. There is a decent chance of the same user coming back with either a different IP, no cookie, or both [freeing them to vote again]. I would check for one or the other.

[ChrisE]

Thanks for the input. I was thinking more along the lines of an OR situation like you suggested in the final sentence.

IP is the same OR cookie indicates voting during the period = don't log the vote.

I'll definitely set up a database with the identifier variables and the votes, along with the timestamp. I'll probably restrict voting to once every week. It should be interesting how abused this system will be. . . I want to do time series analyses on the data so each poll will run for a long time (measured in years).

[ALKateb]

cookies or sessions can be deleted so the user will vote again and you know ppl who are not using static ip adress might have their ip changed when their connection is disconnected

first of all i want to tell you guys i am not a pro .. but i was thinking recently about this and i though! why dont we collect as much information as we can about this visitor and put it all in a string and hash it using md5! this will be his identifier so when he comes again we will likely know that's him when his information hash matches the hash in our database

and if ure asking about what kind of information we can collect about the visitor hmmmm will i have not really given it a deep look but there are lots of things that (as i think) might identify the visitor such as:
1 operating system
2 browser
3 language (language specified in the browser)
4 screen resolution
5 (maybe flash player version if you prefer!)
6 java support
7 country
you can also get their machine timestamp and calculate the difference between the server's timestamp and the client timestamp (considering a margin of let's say few seconds cos their machine might not respond that quick especially if their connection is slow)

the last thing might not be accurate or hard to implement but anyway i just wanted to give you an idea

i dont think it's likely that two visitors will have the same information for all of these! or maybe they will if the website has visitors of tens of thousands maybe!

i dont know what do u think about this guys do u think it could be good idea?