Check user

[shapper]

Hello,

I am creating a Poll system and I need to check if a user has already
voted.

What should be the best way to do this?

1. Should I save the user IP along with its vote in the database?
But does not some users IP change each time they access the
internet?

2. Should I place a cookie in after the user voted?

Well, any help will be great.

Thanks,
Miguel

 

[Laurent Bugnion]

Hi,

Hello,

I am creating a Poll system and I need to check if a user has already
voted.

What should be the best way to do this?

1. Should I save the user IP along with its vote in the database?
But does not some users IP change each time they access the
internet?

It can, yes. IP is not reliable as identification of a person.

2. Should I place a cookie in after the user voted?

It will only identify the browser that the user is using. If the user
changes PC, clears the cookie, or if another user uses the PC, you'll
have problems. So cookies are not reliable for identification of a person.

Well, any help will be great.

Unless you implement a login system, with a secure password, and only
allow logged-in users to vote, you won't be able to do this reliably, I
fear. The Internet is pretty free. That's what allows you to post under
a nickname ;-)

One possible method is to ask the user politely to vote only once. That
will be at least as reliable as using cookies or IP...

Thanks,
Miguel

HTH,
Laurent

 

[Steve C. Orr [MCSD, MVP, CSM, ASP Insider]]

Cookies are the usual approach for this kind of thing.
They're not especially secure but for most polling systems they're secure
enough.
IP addresses won't do the trick since those are changed and shared
frequently by various proxy servers.
If it's important that your system be secure then the best bet is probably
to implement a username & password login authentication system.

 

[shapper]

This is just a simple poll.
It does not need to be really accurate.

I think I will go for the cookie.

Thanks,
Miguel

 

[Laurent Bugnion]

Hi,

This is just a simple poll.
It does not need to be really accurate.

I think I will go for the cookie.

Thanks,
Miguel

That's probably a good idea. You should ask the user for a name anyway,
to avoid blocking users who didn't take part to the poll yet.

To set or read cookies on the client, see
http://www.galasoft-lb.ch/myjavascript/consulting/2001012701/index.html

HTH,
Laurent