Question on Rating items, etc.

scottlucas58 · December 30th, 2008, 11:32 PM

Has anyone improved the rating logic? Digging in today, I noticed, the "save" is a db count and rating store, then a cookie for the user. Having deleted cookies many a time, this does seem like a very good way. Before I add a new table and logic, I thought I'd poll the forum and see if anyone has already dealt with this. Thanks.

Lee Dumond · December 31st, 2008, 12:25 AM

The book discusses alternative methods, including rate locking by IP etc. You are right though, that cookies (and IP, for that matter) are far from foolproof. These are merely convenient-to-implement deterrents from repeated rating. They can't prevent it, because these methods work from the client side. There is no client-side method that can truly prevent someone from jacking your ratings.

A more secure method would be to store rating instances in the database. You would have a table with a username column and an article ID column (or whatever is being rated). When a logged-in user rates something, store their username and the ID of the thing being rated in a record. Do a lookup as part of the rating logic, that prevents a user from rating if a record exists matching the user to the item being rated.

If you have multiple things being rated, you'd have to set up a table for each (ArticleRatings, StoreItemRatings, etc.)

scottlucas58 · December 31st, 2008, 08:44 PM

Quote:

Originally Posted by Lee Dumond

The book discusses alternative methods, including rate locking by IP etc. You are right though, that cookies (and IP, for that matter) are far from foolproof. These are merely convenient-to-implement deterrents from repeated rating. They can't prevent it, because these methods work from the client side. There is no client-side method that can truly prevent someone from jacking your ratings.

A more secure method would be to store rating instances in the database. You would have a table with a username column and an article ID column (or whatever is being rated). When a logged-in user rates something, store their username and the ID of the thing being rated in a record. Do a lookup as part of the rating logic, that prevents a user from rating if a record exists matching the user to the item being rated.

If you have multiple things being rated, you'd have to set up a table for each (ArticleRatings, StoreItemRatings, etc.)

Thanks Lee, I was just being lazy, hoping someone had a nice little neat package all wrapped up.
-s

Lee Dumond · December 31st, 2008, 08:48 PM

Quote:

Originally Posted by scottlucas58

Thanks Lee, I was just being lazy, hoping someone had a nice little neat package all wrapped up.
-s

Always worth a shot.