Hi folks,

I want to prevent users from submitting a form more than once on a website. The system does not need to be totally effective. It just needs to work most of the time. I also do not want to force users to register in order to use the website. However, there would unfortunately be some incentive for them to attempt to submit the form more than once.

It has therefore occurred to me that I may be able to achieve this by keeping a record of form submissions together with the corresponding IP address, and blocking any duplicate submissions. But in order to know if this is a sensible idea, I need to know roughly how often dynamic IP addresses change. I also need to know in order to be able to choose a sensible length of time for which to block each IP address.

Now I know that there is no definitive answer to this question. Obviously some ISPs will force IP address changes more often than others, users who have a modem which powers down with their computer will see more frequent changes, as will dial-up users, and different users will have different fractions of their IP address lease left to run.

So what I'm looking for is a typical figure, or if one is available, a scientifically calculated average. Does anyone know where I might find this information?

Any suggestions would be much appreciated.

Best wishes,

Chris Tidy

And of course, some IP addresses will be shared by multiple users.

Ultimately, the server-side program that processes the form data must handle duplicate submissions in a sensible way, whatever "sensible" means for your form and your data.

For a lightweight solution that catches many of the duplicate submissions (e.g., people who double-click on submit buttons), you could just use an onsubmit event handler that returns false except for the first time it is called.

Hi Darin,

Thanks for the ideas. I'd prefer not to use an onSubmit event handler, as there is so far no JavaScript on the site, and I'd prefer to keep it that way as I'm much happier writing PHP. It will also be ineffective against someone who writes their own HTML form and deliberately uses it to make multiple submissions. I'd like to have some protection against that.

Ultimately keeping a record of IP addresses is a fairly weak type of access control. But I think it's probably stronger than the alternatives which do not require users to register. Cookies and JavaScript are the alternatives I've thought of. I don't believe it's too uncommon a form of access control, either. I am pretty sure than Urban Dictionary uses an IP-based system to limit you to one vote "Up" or "Down" for each entry. Unfortunately, I don't know how long they block each IP address for.

I am not sure how great the risk of blocking legitimate submissions is. Obviously it becomes greater the longer you block a particular IP address for. It might also be high for users whose traffic is routed through a proxy, such as AOL users. I did hear that AOL had started adding an X-Forwarded-For: header to their packets. But I'm not sure if this is added to all packets, and I'm also not sure how to access the information. I was going to write to AOL and ask, but I can't find an appropriate e-mail address. Does anyone know the answer to this question?

There is also the possibility of a system which uses both cookies and the IP address. If the cookie is present, the system can use that as an identifier. If not, it can use the IP address. I think it would also be possible to use cookies to calculate an average time between IP address changes for users. In that case, I would just need a starting figure to use for the blocking time. I'm guessing that a figure of the order of a few days to a week or two is best.

I know this system cannot be perfect, but I think that its disadvantages are likely to be outweighed by the advantage of allowing users the freedom to use the site without registering.

Thanks for the help.

Best wishes,

Chris

Or you can simply redirect to page of your choice soon as the submit button is pressed thus giving less savvy visitors a visual clue that it is sent and any old people with jitters cannot accidentally press it twice.

Kind regards
coolvibes