views:

56

answers:

2

Hello everybody,

I have used a jQuery script in order to have a countdown script on a php page that I am doing, but I would also like to have a score system in it based on the time the user takes to answer some questions.

I am using some drag and drops and click in a certain link into an image map -which is the only correct link in the webpage- and in the three pages I am using this countdown, but I would like to, once the user has completed the drags&drops or clicked the links, get the number on the countdown just when the user clicked on a "submit" button...but I am not even sure if I can do this.

Alternatively, could I use any countdown script that would let me get the actual number that is being showed just when the user click on the submit button?

Thanks a lot everybody in advance!

A: 

Why not just stash the time (as a numeric value) when you want the timer to start, and then just check the difference when you want to know how long it's been? In other words, you've already got the client computer's clock counting, because that's what clocks do. Just remember what time it was when the drag&drop completes (or whatever point in time serves as your reference), and then check the time again in an event handler for the submit button.

Pointy
+2  A: 

Only use the javascript countdown for display purposes, you cannot trust the client.

Keep the count down server side. Store it in the SESSION variable, or in the database.

Javascript is insecure because the client can change it. I could save your page on my machine, open it up, and modify how the timer reports and you'd get a completely different time than you should get. I could also just change the variable using the browsers address bar. The client can always, always change anything in javascript, and you must, absolutely must rely on the server to keep your users honest.

Malfist
That's true, but depending on what the counter is used for that may not be important. For example, if one were using such a setup for gathering some usability metrics, "cheating" (probably pretty rare anyway) would not be of serious concern.If you give coupons to people who are really quick at clicking "submit", then I agree that you don't want to trust client code!
Pointy
Well he said he was generating the score based on the timer, it's unfair to the other users to allow those cheaters to exploit a javascript timer.
Malfist
Well first of all, thanks a lot for your answers! My application is going to be a mere prototype, it's just for a small project for the university and it is aimed for kids who don't have any serious understanding of Javascript, so the security issue is not a big deal.But nevertheless you are totally right about the fact that I should use the countdown on the server side, both because of the security issues and that this way it is so much easier to use the value stored in the $_SESSION in order to compute the score!
noloman