Security for PHP (variables and such)

[Lukeidiot]

Okay i've been working on my new site:
http://lockpick.lukeidiot.com/?go=apply

And I have the Job Application pretty much done, except I want it to be a little more secure. Is it possible to limit the number of 'Submits' a user from a certain IP is capible of submitting a Job Application? (example: user1 from ip: 127.0.0.1 sends in a Job Application Form, and is only allowed one submit per day/week/year) Is this possible?

AKA One submit per IP, per time limit?

Thanks,
Lukeidiot.

[Lukeidiot]

Lukeidiots: when one goes to http://lockpick.lukeidiot.com/resume.php I only want them able to submit once, then the submit button will be disabled for a set amount of time aka day/week/year
friendl: log their IP
friendl: to a list
friendl: and on the process page, compare their ip
friendl: to the list
friendl: and if they're on it, don't let them go on

Is also an idea.
Logging the IP to a MySQL or Writable Text file.
Maybe have 3 Submits, then they cant submit anymore.

[dclamp]

well you cant use $_SERVER['REMOTE_ADDR'] to get the user's IP address and use date('r') as a time stamp, then store in a DB.

then when they come back, check the DB for the IP and if the user is within time limit, deny them

[Lukeidiot]

well you cant use $_SERVER['REMOTE_ADDR'] to get the user's IP address and use date('r') as a time stamp, then store in a DB.

then when they come back, check the DB for the IP and if the user is within time limit, deny them

How should I go about getting the IP into the DB?
I'm not too familar with MySQL inserting and fetching commands and such.

[dclamp]

check the link in my signature for more information of MySQL with PHP.

something like this:

$sql = "SELECT ip, timestamp FROM ip_addresses WHERE ip = '".$_SERVER['REMOTE_ADDR']."' LIMIT 1";
$query = mysql_query($sql);
$num_rows = mysql_num_rows($query);

// $num_rows is how many rows that the ip appears in. if it is more than 0 then the user visited.

if ($num_rows>0) {
//check date
}

[Lukeidiot]

check the link in my signature for more information of MySQL with PHP.

something like this:

$sql = "SELECT ip, timestamp FROM ip_addresses WHERE ip = '".$_SERVER['REMOTE_ADDR']."' LIMIT 1";
$query = mysql_query($sql);
$num_rows = mysql_num_rows($query);

// $num_rows is how many rows that the ip appears in. if it is more than 0 then the user visited.

if ($num_rows>0) {
//check date
}


Thanks. Would I need to create a table before this would work?

Heres the code I'm using

<?php

if(isset($_POST['submit'])) {

$to = "Lukeidiot@gmail.com";
$subject = "Job Application - Resume IP Log";
$iplog = $_SERVER['REMOTE_ADDR'];
$iplogfilelocation = $_FILES['imgfile']['name'];

mysql_connect ("localhost", "******", "*******") or die ('Error: ' . mysql_error());
mysql_select_db ("luke_iplog");
$sql = "SELECT ip, timestamp FROM ip_addresses WHERE ip = '".$_SERVER['REMOTE_ADDR']."' LIMIT 1";
$query = mysql_query($sql);
$num_rows = mysql_num_rows($query);

// $num_rows is how many rows that the ip appears in. if it is more than 0 then the user visited.

if ($num_rows>0) {
//check date
}

$body = "IP Logged: $iplog\r\nResume Submitter: http://lockpick.lukeidiot.com/upload/$iplogfilelocation";
mail($to, $subject, $body);

$uploadpath = "upload/";
$uploadpath = $uploadpath . basename( $_FILES['imgfile']['name']);

if(move_uploaded_file($_FILES['imgfile']['tmp_name'], $uploadpath)) {

echo "Datebase Updated With: ".$
echo "<b>Your Resume:</b> ". basename( $_FILES['imgfile']['name']). " has been uploaded.<br>";
echo "<b>Type:</b> ". $_FILES['imgfile']['type'] ."<br>";
echo "<b>Size (Bytes):</b> ". $_FILES['imgfile']['size'] ."<br>";
echo "<b>File Name:</b> ". $_FILES['imgfile']['name'] ."<br>";
echo "<b>IP Logged:</b> ". $_SERVER['REMOTE_ADDR']."<br>";
echo "<b>Link to Resume: </b><a href='http://lockpick.lukeidiot.com/upload/$iplogfilelocation'>http://lockpick.lukeidiot.com/upload/$iplogfilelocation</a><br>";

}
else {
echo "There was an error uploading the file, please try again!";
}
}

?>

It's unfinished, have to eat brb.