Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.lang.php > #17020

Re: Preventing bombing

Show all headers | View raw

On 09/06/2016 08:28 AM, bit-naughty@hotmail.com wrote:
> If I have a site where people will log in and make posts, what's to stop someone logging in manually, ie. with the password they've signed up to the site with, and THEN running the bombing script to fill up the database with junk?
> I suppose Apache can be configged to prevent too many posts from 1 IP in too little time (is this done by default?), but this is not really a solution.

Apache do not have a magic ball, so it will not be able to limit
anything regarding post, it can throttle the connection speed, but that
ain't the same thing as limiting number of posts requests.


> I would really hate to put Capchas in my site for *each time people wanna post something* - this is really a horrible thing to do to my users. Is there a solution?

You can try to limit the miss use by using a guid which is generated
when the page is loaded, and when the page is posted, compare the guid
with what you have stored on the server side, it they match, process the
page, if they do not match, then ignore the post.

Keep in mind that you can still make automation which can load the post
page, take the guid and use it in the post.


-- 

 //Aho

Back to comp.lang.php | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

Preventing bombing bit-naughty@hotmail.com - 2016-09-05 23:28 -0700
  Re: Preventing bombing Ben Bacarisse <ben.usenet@bsb.me.uk> - 2016-09-06 14:16 +0100
  Re: Preventing bombing gordonb.7fqba@burditt.org (Gordon Burditt) - 2016-09-06 14:28 -0500
  Re: Preventing bombing "J.O. Aho" <user@example.net> - 2016-09-07 07:04 +0200
  Re: Preventing bombing bit-naughty@hotmail.com - 2016-09-07 00:55 -0700
    Re: Preventing bombing "R.Wieser" <address@not.available> - 2016-09-07 10:23 +0200

csiph-web