I'm implementing a like feature for a site I'm working on. A user doesn't have to be logged in and they can either like or dislike a particular page. At the end of it all I'd like to be able to populate a list of articles or stories with the most likes.

I have a very simple method that currently uses an onclick javascript function to update a database via ajax and a php function. This is working ok. What I'd like to do is prevent a user from spamming the button.
At first I thought of maybe getting the IP address, storing that in the database and then running a check. Is there a better way?

I'm implementing a like feature for a site I'm working on. A user doesn't have to be logged in and they can either like or dislike a particular page. At the end of it all I'd like to be able to populate a list of articles or stories with the most likes.

I have a very simple method that currently uses an onclick javascript function to update a database via ajax and a php function. This is working ok. What I'd like to do is prevent a user from spamming the button.
At first I thought of maybe getting the IP address, storing that in the database and then running a check. Is there a better way?

• javascript
• php
• html
• web

• 3 Without having the user login there is no 100% fool-proof way of doing this. Recording the IP Address in your database will prevent multiple people on a subnet from Liking your content. – MonkeyZeus Commented Sep 23, 2013 at 17:29
• Without logging in? I'd suggest a cookie but all approaches will have issues. – mccainz Commented Sep 23, 2013 at 17:29
• cookies may help with this task. Store a cookie when user has clicked like once. And check this cookie upon processing like click. – user784540 Commented Sep 23, 2013 at 17:29
• If you want to prevent SPAM clicking then you can implement a timed IP block such as one like per hour but that's up to you. – MonkeyZeus Commented Sep 23, 2013 at 17:32
• 1 hey steve, I also like to provide non-login users such functionality, but I still log the user records, like you said. Only with IP addresses, without them having a clue they are logged (of course it's ethical to state it in terms of use). While other implementations (like cookies) have easily-trickable flaws, this method has two flaws too: 1) a user can easily change their ip address 2) two people from same network are treated as one user. So you decide, but in my opinion, try to rely on data on your server, not in the users' puter. – jeff Commented Sep 23, 2013 at 18:06

4 Answers 4

Technically there isn't a bomb proof way to do so. You could get pretty close by allowing one vote per ip-useragent bination. You'd have to implement this on the server side.

PHP Example

 $concienceKey = md5($_SERVER['REMOTE_ADDR'] . $_SERVER['USER_AGENT']);

 $query = "SELECT COUNT(*) FROM clickConcience WHERE key = `" . $concienceKey . "`";

 //run your query
 //.....and get the $count;
 //

 //already voted!
 if($count > 0){
      echo 'already voted';
      return false;
 }

 //remember entry
 $insert = "INSERT INTO clickConcience (key, datetime) VALUES (`" . $concienceKey . "`, NOW())";

 //run your query
 //.....and insert
 //

 return true;

straight forward answer, you won't be able to do it.

If I really want to SPAM your "like" button, I will find a way to do so, especially if you're not forcing me to be signed in (I used to write pretty good bots and were pretty efficient spamming big link submission sites).

Javascript will only stop mediocre spammers or sock puppet account holders. As a spammer I can circumvent your Javascript pretty easily, either by programming a time-based robot to like your post, or by sending requests directly to your server (I will not even load your site).

What you need to do, if you really want to prevent spammers from spamming this feature efficiently (efficiency is the keyword here because spammers can still spam your feature, but their likes won't count) is to log every IP that likes a post along with its geographical information (it's not always 100% accurate, but it's a good start) and then run a process in the background that checks for suspicious origins and penalize such likes (either by assigning them less value, or just subtracting them from the total count).

For example if your main audience is people living in the United States, but one post gets a bunch of likes from Mexico, Salvador, India, Australia, Russia, then it's more than likely that there's a spammer behind a proxy or a network similar to TOR and he/she can change his/her IP address at his/her will.

After a few hundred thousand records, you'll have a good base to start blacklisting IP addresses. I usually use R programming language to get statistical information about my databases.

But then again, a good spammer could use a list of IP addresses of promised puters ing from your audience's country or geographical location, and use those IPs to abuse the feature. Those bots are harder to spot, but you can analyze previous posts and e up with useful metrics as "Likes/ment ratio".

If one post has a huge number of likes, but low number of ments, then it's very probable that someone spammed it, but then again I can program my bot to like AND post a ment so the numbers look natural.

I'm not sure what kind of project you're working on, but if it's something similar to link submission, do not rank (whatever your users are liking) by the number of likes.

The number of likes should only be a factor, you can take a look at how HackerNews or Reddit rank the posts (those projects are open source), but it's a bination between multiple factors.

Just hide the button after it has been clicked for the first time.

It does even makes more sense, when using an AJAX handler for sending the click...

Use cookies. Lets say you have a button where the user can like article 123456789

<button id="like" articleID="123456789">Like</button>

script :

function setLike(articleID) {
    document.cookie=articleID+'=y';
}

function hasLiked(articleID) {
    var cookies=document.cookie.split(';');
    for (var i=0;i<cookies.length;i++) {
        var cookie=cookies[i].split('=');
        if (cookie[0]==articleID) return true;
    }
    return false;
}

var button=document.getElementById('like');

button.onclick=function() {
    var articleID=this.getAttribute('articleID');
    if (!hasLiked(articleID)) {
        //register the like in your system
        //...
        //
        setLike(articleID);
    } else {
        alert('You cant like or dislike an article twice');
    }
}

Of course the user can delete all his or hers cookies - but a user can also like the same page / article from 100 different puters. The above prevents the most mon scenario : People repetetively clicking like or dislike a lot of times from the same puter in a short distant of time.