Hello all,

 

Id really appreciate some help using sessions in my PHP contact form.

 

What i would like to achieve is a way limiting each user to submitting the form once every 60 seconds (so im not overrun by Spam). I was thinking of creating some session based on the user's IP (or SID - but i dont really understand that) and just checking the session data.

 

However, i dont understand fully how sessions work, this is what i currently have:

 

//Start the session
$session = session_id();
if($session == "") {
	session_start();
}

//Check if the a message has been sent in the last 60 seconds
$timeLimit = $_SESSION['lastMailed'] + 60 < time();
if (!$timeLimit && $_SERVER['REMOTE_ADDR'] = $_SESSION['ip']) {
	$response['error']['time'] = 'Whoah, slow down there! Please wait 60 seconds before sending another enquiry';
}

//blah blah check the POST data and send the email

//Start timing from when the message was sent
$_SESSION['lastMailed'] = time();
$_SESSION['ip'] = $_SERVER['REMOTE_ADDR'];

 

But PHP is giving me warnings about modifying session data.

 

Sorry im being a bit vague, its just im not too sure what the best way to implement sessions are.

 

I would really appreciate some help.

 

Cheers

Edited March 12, 201115 yr by Major_Disaster

Hello all,

 

Id really appreciate some help using sessions in my PHP contact form.

 

What i would like to achieve is a way limiting each user to submitting the form once every 60 seconds (so im not overrun by Spam). I was thinking of creating some session based on the user's IP (or SID - but i dont really understand that) and just checking the session data.

 

However, i dont understand fully how sessions work, this is what i currently have:

 

//Start the session
$session = session_id();
if($session == "") {
	session_start();
}

//Check if the a message has been sent in the last 60 seconds
$timeLimit = $_SESSION['lastMailed'] + 60 < time();
if (!$timeLimit && $_SERVER['REMOTE_ADDR'] = $_SESSION['ip']) {
	$response['error']['time'] = 'Whoah, slow down there! Please wait 60 seconds before sending another enquiry';
}

//blah blah check the POST data and send the email

//Start timing from when the message was sent
$_SESSION['lastMailed'] = time();
$_SESSION['ip'] = $_SERVER['REMOTE_ADDR'];

 

But PHP is giving me warnings about modifying session data.

 

Sorry im being a bit vague, its just im not too sure what the best way to implement sessions are.

 

I would really appreciate some help.

 

Cheers

i'd prob just use something like recaptcha most spammers wont bother retyping the captcha to keep sending spam

       //Start the session
       $session = session_id();
       if($session == "") {
               session_start();
       }

 

That should just be session_start(); on its own. Make sure its at the top of the file as well so that headers haven't been sent.

 

//Start the session
session_start();

if(isset($_SESSION['lastMailed'])) {
   if($_SESSION['lastMailed'] + 60 < time()) {
       $response['error']['time'] = 'Whoah, slow down there! Please wait 60 seconds before sending another enquiry';
   }
}

Edited March 12, 201115 yr by Jock

       //Start the session
       $session = session_id();
       if($session == "") {
               session_start();
       }

 

That should just be session_start(); on its own. Make sure its at the top of the file as well so that headers haven't been sent.

 

//Start the session
session_start();

if(isset($_SESSION['lastMailed'])) {
   if($_SESSION['lastMailed'] + 60 < time()) {
       $response['error']['time'] = 'Whoah, slow down there! Please wait 60 seconds before sending another enquiry';
   }
}

 

Mmm not meaning to be a pest but could not the spammer just clear there browser? then resend

Mmm not meaning to be a pest but could not the spammer just clear there browser? then resend

 

Are we sure that clearing the browser clears the session? I'm not so sure it does...

Mmm not meaning to be a pest but could not the spammer just clear there browser? then resend

 

Are we sure that clearing the browser clears the session? I'm not so sure it does...

 

If you where storing the session ID in the URL yes, otherwise the default would be cookies and as a result would depend on the lifetime you set.

Edited March 12, 201115 yr by CSN-UK

Are we sure that clearing the browser clears the session? I'm not so sure it does...

mmm yes sessions actually only last as long as u have the browser open and even so when u clear the catche ur session is cleared as well, cause even the session uses a cookie

mmm yes sessions actually only last as long as u have the browser open and even so when u clear the catche ur session is cleared as well, cause even the session uses a cookie

 

Depends on your session settings or even whether you are using default PHP sessions.

EDIT: Scrap that, i didnt have the session_start() at the very top.

 

With regards to just clearing the cache, thats why i was trying to somehow use the user's IP in the Session data? Would that work? What i want is to limit one message send per IP per 60 seconds. Any ideas?

 

You can see my attempt in my OP

Edited March 12, 201115 yr by Major_Disaster

EDIT: Scrap that, i didnt have the session_start() at the very top.

 

With regards to just clearing the cache, thats why i was trying to somehow use the user's IP in the Session data? Would that work? What i want is to limit one message send per IP per 60 seconds. Any ideas?

 

You can see my attempt in my OP

well considering the ip would be part of the session it would still clear that,

I did this at work and I just stored IP addresses and then refreshed the ip list at the end of each day.

session_start(); needs to be the very first line in the script - and to work in IE I think there's a second line but can't remember it off the top of my head.

 

The spammers would be able to get round this 60 sec check by clearing their cookies or using another browser. But there again there'll always be a way round pretty much whatever you do if they're determined enough!

session_start(); needs to be the very first line in the script - and to work in IE I think there's a second line but can't remember it off the top of my head.

 

The spammers would be able to get round this 60 sec check by clearing their cookies or using another browser. But there again there'll always be a way round pretty much whatever you do if they're determined enough!

Nah session_start(); will work alone in all browsers including IE

The second line is:

 

header("Cache-control: private");

 

and fixes a bug in IE in certain situations on Windows XP.