Is this a good anti flood script??

Discussion in 'PHP' started by qwikad.com, Nov 17, 2012.

  1. #1
    I found this script online, but I am not sure if its protection is based on a user's IP address, or is it? Will it stop a user based on how many requests are made from the same IP?



    
    
    
    <?PHP 
    IF (!ISSET($_SESSION)) {    
    SESSION_START();}
    // anti flood protection
    IF($_SESSION['last_session_request'] > TIME() - 2){   
     // users will be redirected to this page if it makes requests faster than 2 seconds    
    HEADER("location: /flood.html");    
    EXIT;}$_SESSION['last_session_request'] = TIME(); 
    ?>
    
    
    Code (markup):
     
    Last edited: Nov 17, 2012
    qwikad.com, Nov 17, 2012 IP
  2. ronaldsg

    ronaldsg Peon

    Messages:
    17
    Likes Received:
    0
    Best Answers:
    0
    Trophy Points:
    1
    #2
    Looks like terribly formated piece of code. Although php functions aren't case sensitive, it's a good practice to write them as in manual.
    As for the code itself, if it will work at all, then it will work only if cookies are supported on browser accessing the site.
     
    ronaldsg, Nov 18, 2012 IP
  3. EricBruggema

    EricBruggema Well-Known Member

    Messages:
    1,740
    Likes Received:
    28
    Best Answers:
    13
    Trophy Points:
    175
    #3
    @ronaldsg; i totaly agree but the answer to the TS is YES it will work, but all uppercase functions should be writen as lowercase functions

    
    <?php
    if (!isset($_SESSION}}
    {
         session_start();
    }
    
    if (isset($_SESSION['last_session_request']) && 
        $_SESSION['last_session_request'] > time() - 2)
    {
         header("Location: /flood.html");
         exit;
    }
    
    $_SESSION['last_session_request'] = time();
    
    PHP:
    better way is to save the browser useragent string + ip address to a database and check it every request.
     
    EricBruggema, Nov 18, 2012 IP
  4. Rukbat

    Rukbat Well-Known Member

    Messages:
    2,908
    Likes Received:
    37
    Best Answers:
    51
    Trophy Points:
    125
    #4
    quikad, it doesn't use the IP address, it uses the browser. If the user has 2 browsers open, makes a request in one, then makes a request in the other within 2 seconds, this script sees that as 2 "users". Sessions are per browser, not per IP or computer.
     
    Rukbat, Nov 22, 2012 IP