Js / php add every minute

Question

What I want to do is that each user gets 1 point every minute. Now I have php code in addpoints.php and then I tried myself with jQuery javascript:

function addpoints() { var userid = document.getElementById('user_id_points'); var postFile = 'addpoints.php?userid='+ userid.value; $.post(postFile, function(data){ $("#points").html(data); setTimeout(addpoints, 60000); }); } 

This works very well and gives a point every 1 minute. BUT one problem is that if you just refresh the page that the script is on, then you get the point .. so you most likely just refresh the page a few times, and then you raise your points.

I was thinking about maybe in addpoints.php do if if (), which checks that the last date is more than 1 minute, and then throw an else else error.

I am just wondering if there is any better idea / thing to prevent a little problem?

Answer 1

Storing the date + time (for example, using a timestamp) the last time the account was increased, next to this account (whether in $_SESSION or in the database) there really will be a solution:

• When a request to increase the bill appears, check the timestamp.
  • if it is more than 60 seconds ago, then increase the score and update the time stamp
  • else, do not update score or timestamp

Answer 2

based on @Pascal MARTIN answer, if the solution is good, you select @Pascal MARTIN answer

 function addpoints() { var userid = document.getElementById('user_id_points'); var postFile = 'addpoints.php?userid='+ userid.value; $.post(postFile, function(data){ $("#points").html(data.html); setTimeout(addpoints, data.ts); }); } 

only gets the timestamp in addpoints_get_ts

 (function(){ var userid = document.getElementById('user_id_points'); var postFile = 'addpoints_get_ts.php?userid='+ userid.value; $.get(postFile, function(data){ setTimeout(addpoints, data.ts); }); })(); 

Answer 3

I would suggest adding the last column to the MYSQL table. So you can make a surprise, they will not cheat.

 mysql_query('UPDATE `users` SET `points` = `points`+1, `last`='.time().' WHERE `last` < '.(time()-60).' AND `user_id` = '.intval($_GET['userid']).' LIMIT 1); 

Alternatively, you can use the SESSION validations to verify that the correct user is invoking the script, or even make sure the user is logged in.;)

Answer 4

You really have to store the timestamp in $ _SESSIONS and not worry about what's in the database. Another nice thing you can do to prevent automated scripts is to enable some authentication to access the page, preferably with a username and strong captcha. Also make sure that you protect against form spoofing and save multiple requests of the same IP address and deny them. This will prevent someone from DOS from using your server with multiple updates. You can use other things to determine if it will be automated, such as IP, referrer verification, etc.