Blocking a submit button or replacing with a string for flood control?

[Bes]

Hi

I am looking to implement some flood control on a form.

I am using AJAX to post the form to PHP, and can echo HTML back into the form page (The user will probably edit the contents of the form multiple times).

The problem is that if the user hits submit over and over, I want to block them from submitting for X seconds. Nothing really happens if they hit submit over and over without editing the form, as PHP sees nothing has changed and just does nothing, but I am worried a bot might change and submit very fast.

I looked at doing something like this on the back- end:

I get strike's value by looking at the epoch time each time they submit the form... If it is < 2 seconds difference, strikes++;.... 3 times in a row (i.e. 3 subs in <=6s), and I want to block them.

This is what I am trying to do: As you can see, I am passing the submit button to my 'front end' from the 'back end' php script, in the hope I can manipulate this feedback to acheive what I want.

	if ($_SESSION['strikes']>2)
		{
echo 'Temp Block or whatever';
sleep(5);
}
echo '<input type="submit" name="preview" value="Preview" onclick="inEdit(5);">';

WHen I use Sleep, I seem to logjam the script with requests if I hit submit over and over and it takes ages to clear. Any ideas why?

Thanks

 

[Bes]

Any ideas at all?

 

[RobH]

Sleep actually halts the execution of the script, what actually happens on the page when you spam the submit button? I can't understand what you mean 'takes ages to clear'.

You could use AJAX to block the submit button, for example if they get 3 strikes you send some JSON/XML back to the browser which triggers an event to disable the submit button for a few seconds (using a timer). This won't stop people manually POSTing to the form URL but hopefully your server side script will deal with that.

 

[Bes]

Well what happens is the submit button is still visible and can still be clicked over and over.however, the script abides by the sleep fuction and 10 fast clicks=10x5 seconds of sleep with the button still visible. Removing sleep and the vutton code there makes it replace the button with a string on submit, so don't understand what us wrong. Can't any ajax just be modified by the user anyway, making it useless?