ajax rating script - avoid voting again

What's the best a开发者_StackOverflowpproach to achieve this? With cookies or with IP control?

---

It's no different to a non-Ajax version.

It depends on who you are willing to risk making a false positive, and how many false negatives you can stand, and how much effort you want to make people go through.

CAPTCHAs lock out some users, annoy more users, but are fairly effective at stopping bots and slowing down manual revoting.

Cookies can be deleted, and are ignored by bots, but slow down manual revoting.

IP logging stops multiple people from the same IP (e.g. via NAT), and people can change their IP.

Registration with a unique email address is a lot of effort for users, and requires them to give up personal information, but is fairly effective.

There's no solution that is really 'good'. You just have to decide which bits of 'bad' you can stand.

---

No solution will be 100% accurate. I believe that using cookies is better. Still a user may vote twice (once from home and once from work). The same thing also applies for IPs.

The problem with IPs is that people working in the same office may appear to your server that they are coming from the same IP. Using IP to lock a vote will allow only one of them to vote.

Also IPs are more difficult to implement. You need to store voters IPs in a database. Using cookies is simpler.

Another solution will be to force users to register. This way you will have one vote per email address. Anonymous voting will not be allowed though.

---

A user can delete a cookie, and their IP address can change. I'd still go with IP though.

---

The solution you adopt will depend on how accurate the voting results need to be and how serious the effect of multiple votes would be. Remember anything short of full registration will open your system up for multiple voting. In fact you could still vote multiple times with registration - just enter a new e-mail address each time.

If it's just a vox pop poll, then cookies is probably the way to go.

If there are real consequences of voting (winning prizes etc.) then you need to go for full registration.

So the answer is that it all depends.