How save ip of user, who use random generated ip?

Question

in my project i need to allow rating system for users only once. i have a table in my database, where i store all ip addresses, and i check, if the user's ip is not in database, i allow rating.

But now i met a problem.

There are providers, that generate random ip addresses every time user restart computer.

So when i call $ip=$_SERVER['REMOTE_ADDR'];, every time it returns different result from the same computer.

I also tried something like

if (!empty($_SERVER['HTTP_CLIENT_IP']))   //check ip from share internet
    {
        $ip=$_SERVER['HTTP_CLIENT_IP'];
    }
    elseif (!empty($_SERVER['HTTP_X_FORWARDED_FOR']))   //to check ip is pass from proxy
    {
        $ip=$_SERVER['HTTP_X_FORWARDED_FOR'];
    }
    else
    {
        $ip=$_SERVER['REMOTE_ADDR'];
    }

But it doesn't help.

How can i solve this problem?

Thanks much

Answer 1

The only way to effectively combat this is to use a unique login system, but even then, users can create multiple accounts.

Answer 2

In addition to the ip check you can implement a cookie, it is not a perfect solution but, if user don't erase it you can leverage on this second check to find duplicate voting attempts

Answer 3

You have to accept that some users will have changing IP's.

If your voting system is important, consider adding registration, email verification along with IP checks to filter out primitive cheats.

Again though it's always quite easy to cheat on those sorts of systems (web proxies for example)

Answer 4

There is no way of getting the users old IP from the server superglobal.

Cookies could also work, but not really feasible for a sinple rating system.

Answer 5

You could use setcookie to write a cookie to a user's hard drive following a vote. Of course it would be easy for savvy users to remove this and vote twice.

Answer 6

Best option would be to force them to register, in order to rate/vote.

There is no absolute way you'll be able to keep track of them otherwise.

Answer 7

You can use combination of both setting a cookie on client and storing IP address, you can also get a copy of public proxies and blacklist the ip address, plus email verification.

thats the maximum extent, its not full proof if the person cleans the cache and has a dynamic IP but you can slow down the spammer.