Ajax star rating bar

[eluser]wiredesignz[/eluser]
It appears someone (who shall remain nameless, but has a Bear avatar), was able to send 1000 votes to the rating system. :lol:

I really didn’t bother to improve the security from the original script. But now I would suggest adding a limit field to the table with which to compare the submitted vote.

Modified ratings table

Code:

-- Table structure for table `ratings`

CREATE TABLE `ratings` (
  `id` varchar(11) NOT NULL,
  `total_votes` int(11) NOT NULL default '0',
  `total_value` int(11) NOT NULL default '0',
  `vote_limit`  int(11) NOT NULL default '0',    //added vote limit
  `used_ips` longtext,
  PRIMARY KEY  (`id`)
) ENGINE=MyISAM DEFAULT CHARSET=utf8;

Modify application/controllers/ratings_rpc.php

Code:

//get the current values!
if ($numbers = $this->ratings_model->findBy_id($id_sent))
{
    // kill the script if vote limit is exceeded.
    if ($vote_sent > $numbers['vote_limit']) die("Sorry, your vote appears to be invalid.");
    
    $checkIP = unserialize($numbers['used_ips']);
    $count = $numbers['total_votes']; //how many votes total
    $current_rating = $numbers['total_value']; //total number of rating
    $sum = $vote_sent + $current_rating; // add together the current vote value and the total vote value
    $tense = ($count == 1) ? "vote" : "votes"; //plural form votes/vote
}

...

//get the new values!
if ($numbers = $this->ratings_model->findBy_id($id_sent))
{
    $checkIP = unserialize($numbers['used_ips']);
    $count = $numbers['total_votes']; //how many votes total
    $current_rating = $numbers['total_value']; //total number of rating
    $tense = ($count == 1) ? "vote" : "votes"; //plural form votes/vote
    $units = $numbers['vote_limit']; //get the vote limit
}

Modify application/models/ratings_model.php

Code:

// get votes, values, ips for the current rating bar
if (!$numbers = $this->findBy_id($id))
{
    // insert the id in the DB if it doesn't exist already
    $data = array(
        'id' => $id,
        'total_votes' => $count,
        'total_value' => $current_rating,
        'vote_limit'  => $units,        //set the vote limit
        'used_ips' => '',
    );
    $this->insert($data);
}

...

function findBy_id($id)
{
    $this->db->select('total_votes, total_value, vote_limit, used_ips');
    $query = $this->db->getwhere('ratings', "id = '{$id}'");
    return $query->row_array();
}