PHP Timer security

I have a timer on the site which the user will only be able to click on every * seconds/minutes/hours. Every user has a timer value in the users table where the values are written and read. The value in the database is the amount of seconds that the user will have to wait.

I've figured out how to make the timer countdown from the correct value in the sql database but I have yet to figure out how to make it servside secure.

What would be the most effective way to detect when clicking to earl开发者_运维知识库y?

Hm, when user clicks, you record the time (server time), subtract the value from the db and see if it is less than the value that's been set.

Maybe you should provide more detail...

I am with Playcat on this.

On first click store the time in the database. On second click select first click; Check if now – firstclick < userTimervalue

IF so then the the user didn’t wait long enough return false ELSE return true and update firstclick to currenttime.

The only thing I would add is you should add clientside javascript to mimic the timer it can reduce the checks against the database.

You can either fetch the whole record and compare using PHP, or issue a SQL command checking it. Assuming MySQL:

SELECT IF(COUNT(id), 1, 0) AS allowed FROM some_table
WHERE NOW() > DATE_ADD(timestampCol, INTERVAL 5 MINUTE) AND user_id = :userid;

http://dev.mysql.com/doc/refman/5.1/en/date-and-time-functions.html#function_date-add

Not sure what that has to do with "security" as it's commonly referred to though. If your question is "how do I secure an application", the question is too broad for quick answer. If your question is "how do make sure this works", then this is the way.