davo Posted October 18, 2014 Share Posted October 18, 2014 I'm making my 'just for fun' site to compare two portraits and the user selects the better looking one. I'm looking for ideas around security. The following code selects two users and the user clicks on one of them, submitting it back to the current page which then updates the scores by 1 point. One issue that i've come across is, if the just refreshes the page then the same score is updated again... meaning once you've found an image that you want to support you keep hitting refresh. Any simple ideas how I can prevent this? <?php $p1 = $_SESSION['p1']; //load up the previous person 1 $p2 = $_SESSION['p2']; //load up the previous person 2 $winner = $input->urlSegment1; //winner is the first segment $person1 = $input->urlSegment2; //person 1 is the 2nd segment $person2 = $input->urlSegment3; //person 2 is the 3rd segment if (($winner !=="")&&($winner == $p1 || $p2)){ //if the winner value is not blank and it is also equal to p1 or p2 $update_user = $pages->get("id=$winner"); //find the winning user by id $update_user->score = ++$update_user->score; //add 1 to the score $update_user->of(false); //something about entities $update_user->save(); //save it all up if ($person1 !== $winner){ //ooh.. time to update the loser $update_user = $pages->get("id=$person1"); $update_user->score = --$update_user->score; $update_user->of(false); $update_user->save(); } if ($person2 !== $winner){ //ooh.. time to update the loser $update_user = $pages->get("id=$person2"); $update_user->score = --$update_user->score; $update_user->of(false); $update_user->save(); } //let us find some detail about the current user $user_gender = $user->Gender; $user_ethnicity = $user->ethnicity; if($user->isLoggedin()) { $user_id = $user->id; }else{$user_id = $_COOKIE[id];} $user_country = $user->country; $user_sexual_preference = $user->sexual_preference; if($user->isLoggedin()) { $visits = wire('users')->get("$winner"); $visits->of(false); $visit = $visits->visiting_person_data->makeBlankItem(); $visit->date = date("Y-m-d H:i"); $visit->visitor_id = $user->id; $visit->gender = $user_gender; //used only for testing $visit->ethnicity = $user_ethnicity; //used only for testing $visit->country = $user_country; //used only for testing $visit->sexual_preference = $user_sexual_preference; //used only for testing $visits->visiting_person_data->add($visit); $visits->save("visiting_person_data"); } } //close the if winner set // echo "$result score = {$update_user->score}"; // time to make the new set of contestants $gender_array = $pages->find("parent=1016"); //this parent holds child pages to specify gender $gender_select = $gender_array->findRandom(1); //select the gender so we can compare like for like - its only fair // echo "$gender_select"; $contestantarray = $pages->find("template=user, profile_image>0, Gender=$gender_select, include=all"); //get all the users that have images and the gender matches the selection to compare like for like $contestants = $contestantarray->findRandom(2); //grab two random contestants $p1 = $contestants[0]; $p2 = $contestants[1]; // echo "p1 $p1 p2 $p2"; $_SESSION['p1'] = $p1; //send contestand 1 to the next page for security $_SESSION['p2'] = $p2; //send contestant 2 to the next page for security foreach ($contestants as $contestant) { $lineup = $contestant->profile_image; //create the contestant $thumb_contest = $lineup->size(200, 200); //create a thumbnail echo "<div class='col-md-3'><a href='/contest/{$contestant->id}/$contestants[0]/$contestants[1]'><img class='img-thumbnail' src='{$thumb_contest->url}'></a></div>" ; //output the thumbnail } ?> Link to comment Share on other sites More sharing options...
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now