The way I have seen this done (here) is that you have to type in your email address, the key is emailed to you, and then you enter it when you vote. This is a form of registration, but it's not permanent and only an email address is needed.

--ZZamboni

I've done both cookies and IPs in the past. Users coming in from dial-ups can always reconnect, delete the cookies and vote again, but that is such a pain in the 455 that I can't see someone doing it over and over and over. Even permanent IP users could spoof the address and do the same process, but that's even a worse case of nothing-better-to-do-with-ones-life.

#!/home/bbq/bin/perl
# Trust no1!

if (defined $visitlog{$newipadd}) {
  # maybe check $USER_AGENT && $othrsave stuff to examine
  # if anything further about unique proxy users can be determined
  #failure code && error mesg
} else {
  # maybe check $USER_AGENT && $othrsave stuff to further
  # determine if the user is attempting to revote.
  #process vote && success mesg
  $visitlog{$newipadd} = "$USER_AGENT" . $othrsave;
}
[download]

> Then suck each line into a regex like /(\S+)\s(.*)/ so that $1 has the
> IP and $2 is the rest of the info you'd want to store...

Quick note: For a large list like the one potentially generated by such a script, a regex will not be as efficient as a split.

I was under the impression that split employs regexes to do it's bidding and if no particular one is specified, it defaults to /\s+/. Maybe it also runs a =~ s/^\s+//; before matching the split field. I'm not sure about the underlying implementation but I thought one of my O'Reilly boox described split like this. Is that not the case? TTFN & Shalom.

-PipTigger

The main problem with this, and others below that only use the IP address, is that proxies mess everything up. Glancing through my access_log, I seem to have an awful lot of people from cache-rc09.proxy.aol.com and similar hosts. You need to either specify a timeout, use cookies, or use the HTTP_USER_AGENT value. Better yet, use all three.

Start by checking for a cookie. If it is found, stop (don't allow the vote). If not, check the IP. If it has not been seen before, go (allow the vote, save the IP). Otherwise, check the user agent. If it's new, go. If not, check the timeout. If it's over a certain time (say, 2 days) you might allow it anyway. Some pseudo-code:

$ip=$ENV{'REMOTE_HOST'};
$br=$ENV{'HTTP_USER_AGENT'};
$timeout = 60*60*24*2; ## sec x min x hours x 2 days = seconds in 2 da
+ys

$cookie_found and &NoVote; ## NoVote exits

## Load data file, check for a match
open (IP, "< $ipfile") or &SeriousError;
$found=0;
while(<IP>) {
  m/^$ip/ or next;
  $found=1;
  ## IP matches - does the browser?
  (undef,$brow, $time) = split(/##/,$_); 
  if ($br eq $brow) {
    ## Browser matches too - allow a timeout?
    $^T-$time>$timeout and &Vote; ## exits
  }
}
&Vote if !$found; ## This is a new IP
&NoVote;

sub Vote {
  ## Voting code here

  ## Set a cookie
  print "Set-cookie: etc...";

  ##..and in case that doesn't work or they delete it:

  if (open(IP, ">>$ipfile")) {
    print "$ip##$br##$^T\n";
    close(IP);
  }
  exit;
}
[download]

A final trick to slow down ballot-stuffing (someone *could* write a perl script that changes the user agent every time, in theory) is to limit the rate of voting by sticking a sleep(15) in there, or by allowing the same IP but different user agents to vote only after a timeout of 30 seconds.

Argh! Not the "IP for unique votes" cargo-cult junk again! How many times do we need to go through this?

Repeat after me:

• An IP address is not a user
• An IP address is not a user
• An IP address is not a user
Trivial counter-examples:
1. AOL.com's proxy, where every hit comes from a different address, even within the same session
2. Dialup sessions (including most cable modems) where every session is a different IP
3. Proxy servers for nearly all of the corporate access
Please don't make me have to repeat this stuff Yet Another Time.

-- Randal L. Schwartz, Perl hacker

Please be nice. Many people have never had to consider this problem before and therefore would have no way of knowing these things. Maybe it's YetAnotherTime for you but that's what cooperative forums for a community of any sort have to deal in 99% of the time. That's what FAQ's are all about and why it's great to reference them for answers. Thanks very much. TTFN & Shalom.

-PipTigger

sub already_voted {
  my ($ip_address, $user_agent) = @_;
  my (@lines, $line, $file_ip, $file_ua, %voters, $voted); 
  
  # Open our list of IP address and user agents. 
  # This is in the format:
  #
  # IP_address:::UserAgent
  #
  open (IPADDRESS, "<ips.txt"); 
  @lines = <IPADDRESS>;
  close IPADDRESS; 

  # Parse the array and store IP and User Agent in a hash. 
  foreach $line (@lines) { 
    chomp $line; # Remove \n
    ($file_ip, $file_ua) = split(/:::/, $line); 
    $voters{$file_ip} = $file_ua; 
  }

  # Check to see if the IP of the person currently voting 
  # is in the hash. 
  if (exists($voters{$ip_address})) { 
    
    # It looks like the same person is voting again. Stop the
    # evil person. But wait, let's check the user agents too.

    if ($voters{$ip_address} eq $user_agent) {
      # Same IP, same user-agent. Looks like a duplicate vote.
      $voted = 1;

      sharedcode::logfile("Bad: dup vote $ip_address and $user_agent."
+);.
    }
  }

  # Let's put *this* vote into the file:
  open (IPFILE, ">>ips.txt");
  print IPFILE "$ip_address".':::'."$user_agent\n";
  close IPFILE; 
  
  if ((-M "ips.txt") >= 7) { 
    # File is getting old, let's clear the file. 
    open IPFILE, ">ips.txt"; 
    print IPFILE " "; 
    close IPFILE;
  }
  
  return $voted; 
}
[download]

open(INFILE, "< listofips.txt");
$filesize= -s INFILE;
read(INFILE, $wholepage, $filesize);
close(INFILE);
if( !($wholepage =~ m/$ENV{'REMOTE_ADDR'}/) )
{
    open(OUTFILE, ">listofips.txt");
    print OUTFILE "$wholepage\n";
    print OUTFILE $ENV{'REMOTE_ADDR'};
    close(OUTFILE);
    # add vote stuff here

}
[download]

Yeah, there are simpler ways to keep a list of IPs. As the list grows, time to check them increases tremendously.

If you really must do it this way, use a database. Even something simple like DBD::CSV would help immensely.

Specific things in your code that I'd do differently are:

• Error checking (always check the return value of open calls!)
• Open the IP list for appending, at least. ">> listofips.txt". That way, you don't have to write the whole thing at once.
• Setting $/ to undef and slurping the whole file into a scalar instaed of using read.
But tracking IP addresses really isn't the way to go here, as merlyn and others have pointed out.