如何防止自己的职位投票？

Question

I have a table named Votes like this:

// Votes
+----+---------+------------+---------+-------+------------+
| id | post_id | table_code | user_id | value | timestamp  |
+----+---------+------------+---------+-------+------------+
| 1  |  1424   | 2          | 433     | 1     | 1445898101 |
| 2  |  53431  | 4          | 54      | -1    | 1443891149 |
  .     .        .         .       .
  .     .        .         .       .  
+----+---------+---------+-------+------------+

Now I want to know, how should I check Votes table that the new vote is belong to his-own-post or that post is from other guy? Should I check $_SESSION['user_id'] with what?

Answer 1

You should check for this when they're trying to vote, and not allow the vote. Do a query like:

SELECT author_id
FROM Posts
WHERE id = $_POST[post_id]

Then check if the author is the same as the current user:

if ($row['author_id'] == $_SESSION['user_id']) {
    echo "You can't vote on your own posts!";
} else {
    // insert into Votes table
}

If you want to do the check in INSERT query, you can do it like this:

INSERT INTO Votes (post_id, user_id, value, timestamp)
SELECT $post_id, $user_id, $value, $timestamp
FROM DUAL
WHERE $user_id != (SELECT author_id FROM Posts WHERE id = $post_id)

Then to report the error, you can get the number of rows affected by the query; if this is 0 , it means they tried to vote on their own post.

if (mysqli_affected_rows($conn) == 0) {
    echo "You can't vote on your own posts!";
} else {
    echo "Thank you, your vote has been recorded.";
}

Answer 2

You could do the check within your MySQL query. Don't forget to protect against MySQL injection. Not 100% sure about the syntax, but this should give you a good idea.

$answer = $MySQL->query("UPDATE Votes SET ['value'] = (['value']+1) WHERE post_id = ".$post_id." AND user_id != ".$SESSION['user_id']);
if($answer) return "Upvoted";
else return "Can't upvote yourself !";

EDIT :

You should actually do a check in your Posts table first

$userWhoPosted= $MySQL->query("SELECT user_id FROM Post WHERE post_id = ".$post_id);
if($userWhoPosted != $_SESSION['user_id']){
    $answer = $MySQL->query("INSERT INTO Votes (post_id,user_id,value,timestamp) VALUES (".$post_id.",".$user_id.",".$value.",".$timeStamp.")  ")
}  
else return "Can't upvotes yourself";

EDIT 2 :

$answer = $MySQL->query("INSERT INTO Votes (post_id,user_id,value,timestamp) VALUES (".$post_id.",".$user_id.",".$value.",".$timeStamp.") WHERE user_id != (SELECT user_id FROM Post WHERE post_id = ".$post_id.")  ")

Answer 3

You didn't give us enough information, but there is a classical solution in MySQL

CREATE TABLE Votes
(
// your fields here
CONSTRAINT uc_post_user_vote UNIQUE (post_id,user_id,value)
)

It means that one user won't be able give vote up or down twice for the same post. Think abobut this, I hope it'll help you.