如何验证用户的Facebook ID以防止再次重新提交

Question

I have a picture contest using php which allows you to enter to upload or enter to vote. It also only allow one facebook user to upload one picture to the event at most.

How can I validate their facebook ID with MySQL data, such that the same user who already submitted once (according to the fbID) is not able to click the enter contest button again and when clicked, a msg box will pop out saying "You have already submitted once"?

Hope you guys will give suggestions. Thanks and appreciated all of your time for helping me.

Answer 1

Simply store the Facebook user ID alongside the photo submission in your database.

I assume you'll have a table that contains the photo data; create a new field to store the Facebook user ID too. Then, when the user visits your app or whatever, check if their ID is already in the database. If so, don't give them the upload form but an error message; if not, allow them to upload.

EDIT: Check out Facebook's SDK . There should be example's on there to fetch the details of the user viewing your app's page, which includes Facebook ID. You can then use that in your script.

<?php

require 'facebook.php';

$facebook = new Facebook(array(
    'appId'  => 'YOUR_APP_ID',
    'secret' => 'YOUR_APP_SECRET',
));

$user = $facebook->getUser();

if ($user) {
    try {
        $user_profile = $facebook->api('/me');
    }
    catch (FacebookApiException $e) {
        error_log($e);
        $user = null;
    }
}

if ($user) {
    $logoutUrl = $facebook->getLogoutUrl();
}
else {
    $loginUrl = $facebook->getLoginUrl();
    echo "<script>top.location.href='$loginUrl';</script>";
    exit;
}

// if we're here, the user has successfully authenticated
// you now have access to their profile in $user_profile

$userId = intval($user_profile['id']);

// logic goes here to query database and check if $userId
// has already been used to submit a photo or not

Answer 2

You'll need to authenticate the user and grab the FB cookie.

See the documentation on the FB developer site .

Once you have the id, you can pull it from the db and use it to check if the user has submitted or not.