避免重複投票

Question

我是PHP/MySQL和整個網站設計的新手。我正在建立一個預定義用戶可以投票的網站。我有一個包含用戶列表的數據庫。我正在努力避免重複投票。我讀過你可以阻止IP地址或使用cookie，但我試圖使用另一種方法。

在我的數據庫名爲'用戶'我有三列 - 用戶名，密碼和標誌。 標誌的默認值爲0.一旦用戶投票，我將該特定用戶的標誌設置爲1.現在，如果用戶試圖再次投票，我想檢查數據庫中標誌的值。如果它是0，我會將他發送給「感謝您投票」頁面，並更新我創建的另一個數據庫，稱爲結果，以記錄每個候選人收到的投票數。如果不是，我帶他到另一頁說：「你已經投了票。」到目前爲止，一切正常，除非我不知道如何讀取數據庫中的標誌值並使用它的if條件。

這是我到目前爲止有：

<?php 

$host="localhost"; // Host name 
$username="dbxxxxx"; // Mysql username 
$password="password"; // Mysql password 
$db_name="dbxxxxx_users"; // Database name 
$tbl_name="users"; // Table name 


// Connect to server and select databse. 
mysql_connect("$host", "$username", "$password")or die("cannot connect"); 
mysql_select_db("$db_name")or die("cannot select DB"); 

$user = $_COOKIE["details"]; //cookie details has the username the user used to log in 

$SQL = "SELECT flag FROM users WHERE Username='$user'"; 
$flag = mysql_query($SQL); //no clue what's happening here. Just trying random stuff 
$db_field = mysql_fetch_assoc($flag); 


if($db_field==0)  //checking the value of flag in the database 
{  
    mysql_query("UPDATE result SET Votes=Votes+1 //if flag in database = 0 
    WHERE Name='Candidate1'"); //updates result for candidate1 if the user voted for 1 

    $user = $_COOKIE["details"]; //reading the cookie again. can be omitted. 

    mysql_query("UPDATE users SET flag=1 //changing flag to 1 so user cannot vote again 
    WHERE Username='$user'"); 

    header("location: http://www.lithuaniavote.com/thankyou.html"); 
} 

else //flag != 1 or user has already voted 
{ 
    header("location: http://www.lithuaniavote.com/alreadyvoted.html"); 
} 

?> 

PS：此代碼更改爲0的標誌1在數據庫中。但是，if條件有問題。即使標誌爲1，我也能夠投票，這表明我已經投了票，換句話說，它從未將我帶到已投票頁面。

Answer 1

原始代碼：

$SQL = "SELECT flag FROM users WHERE Username=$user"; 
$flag = mysql_query($SQL); //no clue what's happening here. Just trying random stuff 
$db_field = mysql_fetch_assoc($flag); 
if($db_field==0)  //checking the value of flag in the database 

試試這個：

$SQL = "SELECT flag FROM users WHERE Username = '$user'"; // $user should be in 'quotes' 
$flag = mysql_query($SQL); // This is the actual query to the database 
$db_field = mysql_result($flag, 0); // This is the result of the query. 
if($db_field===0) // Use 3 equals signs instead of 2 in this case (which means "exactly equal to") 

Answer 2

我想你應該嘗試一個更清潔（和前瞻性）的方法。讓我重新構建解決問題的方法與PDO：

namespace Voting { 
    $pdo = new \PDO("mysql:host={$host};dbname={$db_name};charset=utf8", $username, $password); 

    if ($query1 = $pdo->prepare("SELECT `flag` FROM `users` WHERE `Username` = ?;", [\PDO::ATTR_CURSOR => \PDO::CURSOR_FWDONLY])) { 
     if ($query1->execute([$_COOKIE["details"]])) { 
      $result = $query1->fetch(\PDO::FETCH_ASSOC); 

      if (intval($result["flag"]) === 0) { 
       if ($query2 = $pdo->prepare("UPDATE `users` SET `flag` = '1' WHERE `Username` = ?")) { 
        $query2->execute([$_COOKIE["details"]]); 
        $pdo = null; 
        header("Location: http://www.lithuaniavote.com/thankyou.html"); 
       } 
      } else { 
       $pdo = null; 
       header("Location: http://www.lithuaniavote.com/alreadyvoted.html"); 
      } 
     } 
    } 
} 

警告：考慮到我沒有檢查$_COOKIE安全。您必須進行某種形式的衛生處理以防止注射和其他漏洞。