Easily avoidable. Record somewhere the time that you issued the quiz to that session. On subimssion, check that it has been submitted within the allowable timespan.

Or, encrypt the time that it was sent in a hidden field. When you get the form back decrypt the time.

Remember to include somewhere the mention that attempts to circumvent the time limit will void the quiz entry.

The key here is use three methods:

1. Instruct the user to take less than 20 minutes on the test.
2. Instruct the browser to automatically submit the form after 20 minutes using the javascript in above posts
3. Enforce in the CGI script, by securely associating each issue of the quiz with a time, either stored locally or securely encrypted in the form.

srand 3.14159; print join("",
sort{rand 1<0.5}map{$_^"\037"}split m{
}x,"qmptk|z~wOzm??l]pUqx^k?j"),",\n";
[download]