PHP - page counter script. what is wrong?

Question

hi. i made this script that add in a mysql database information about who have visited my website.

session_start()

if(!isset($_SESSION['log'])) { 
   $ip=$_SERVER['REMOTE_ADDR'];
   $date=date("Y-m-d H:i:s");
   $browser=$_SERVER['HTTP_USER_AGENT'];
   $browser=mysql_real_escape_string($browser);
   if(isset($_SESSION['nickname'])) {
       $user=$_SESSION['nickname'];
   } else {
       $user="unknownABCD1234";
   }
   $insert=mysql_query("INSERT INTO views (ip, user, date, browser) VALUES ('$ip', '$user', '$date', '$browser')", $mydb);  
   $_SESSION['log']='logged';
   $_SESSION['iplog']=$ip;
   $_SESSION['datelog']=$date;
}

the problem is that it adds the referencee for each user many times (but not ever, just sometimes). example, i find on my db infos like these :

ID: 1
IP : 95.108.244.252
USER : unknownABCD1234 
DATE : 2010-08-07 01:16:00
BROWSER : Mozilla/5.0 (compatible; YandexBot/3.0; +http://yandex.com/bots)

ID : 2 
IP : 95.108.244.252 
USER : unknownABCD1234 
DATE : 2010-08-07 01:16:04
BROWSER : Mozilla/5.0 (compatible; YandexBot/3.0; +http://yandex.com/bots)

that's impossible no? i sure that the session during more than 4 seconds :) what happen?

Answer 1

Write session_start() at the start of code. (For more clarity in the question)

Although default session timeout is 1440 sec in PHP. By default, session closes after browser shutdown. Knowing that the application log contains a bot, most likely it is doing the same thing. (opening and closing the connections)

Answer 2

The bot is discarding session info and ignoring your cookies.

This means that it shows up multiple times in your log. Yes, it does hit your site quickly and without session info, so you don't filter it out.

Your best option is to have some kind of duplicate filter for bots or IPs that hit quickly and repeatedly this way. You might also try adding explicit ignores to the few bot user agents that cause this problem with your script. By the time you have 10 or 15, you'll have dealt with the majority of the problem UAs.

Answer 3

EDIT ok, that's the new version of "counter" with the IP check :

// views.php i do this at the begin of each page
$actualdate=date("Y-m-d H:i:s"); 
$ip=$_SERVER['REMOTE_ADDR']; 
$query=mysql_query("SELECT date, id FROM views WHERE ip='$ip' ORDER BY date DESC",$mydb); 

$idipv=mysql_result($query,0,'id'); 
$actualts=strtotime("-20 minutes"); 
$lastts=strtotime(mysql_result($query,0,'date')); 

if($lastts<=$actualts) { 
    $browser=$_SERVER['HTTP_USER_AGENT']; 
    $browser=mysql_real_escape_string($browser);     
    if(isset($_SESSION['nickname'])) { 
        $user=$_SESSION['nickname']; 
    } else { 
        $user="unknownABCD1234"; 
    }         
    $insert=mysql_query("INSERT INTO views (ip, user, date, browser) VALUES ('$ip', '$user', '$actualdate', '$browser')", $mydb);             
} else { 
    $update=mysql_query("UPDATE views SET date='$actualdate' WHERE id='$idipv'",$mydb); 
} 

// login.php i do this only when a user try to log in
include("../auth/views.php");     

$query=mysql_query("SELECT nickname, password, admin, accessres FROM users WHERE nickname='".$_POST['nickname']."'",$mydb); 

if(mysql_num_rows($query)==0){ 
    mysql_close($mydb); 
    header("location: ../index.php?general=login&messaggio=1"); 
} else { 
    $crypass=md5($_POST['password']); 
    if (mysql_result($query,0,'password')!=$crypass) { 
        mysql_close($mydb); 
        header("location: ../index.php?general=login&messaggio=1"); 
    } else { 
        $nickn=mysql_result($query,0,'nickname'); 
        $_SESSION['nickname']=$nickn; 
        $_SESSION['admin']=mysql_result($query,0,'admin'); 
        $_SESSION['accessres']=mysql_result($query,0,'accessres'); 

        $ip=$_SERVER['REMOTE_ADDR'];         
        $update=mysql_query("UPDATE views SET user='$nickn' WHERE id='$idipv'",$mydb); 

        if(isset($_POST['remember'])) { 
            $cookie=$nickn."%%".$crypass."%%".md5("PAROLAMAGICA"); 
            setcookie("saveduser",$cookie,time()+31536000, "/", false); 
        } 
        mysql_close($mydb); 
        header("location: ../index.php?status=usermain"); 
    } 
}

this should work! the only problem is when a user close his router, his ip is dinamic and that ip will get by another user in 20 minuts (i dubt so...)

let me know