Member Avatar for aianne

Hello everyone! I am a student and I am currently working for online voting system for my school. I am having a hard time how to prevent users/students from multiple votes. Could please give me some example that users can only vote once using their ID number? I have a login system. I know there is a lot of tutorial out there but mostly they used IP address. Any help would be greatly appreciated. This is my code so far:

-----CUT-----

    <form action="candidates.php" method="post">
    <?php
    include('voting_connect.php');
    {
    $result = mysql_query("SELECT * FROM candidates WHERE c_position='President'")
    or die(mysql_error());  

    echo "<center><table id='tables' class='sortable'>";
    echo "<tr><th scope='col' abbr='' class='nobg'>&nbsp;&nbsp;</th> <th>President:</th></tr>";

    while($row = mysql_fetch_array($result))
      {
    echo "<tr>";
    echo "<td scope='row' class='spec'>" . '<input name="selector[]" type="radio" value="'.$row['c_ID'].'">' . "</td>";
    echo "<td>";
    echo '<a href=# alt=Candidate Profile rel=tooltip content="<div id=imagcon><img src='.$row['c_Location'].' class=tooltip-image/></div><div id=con>Running for:'.$row['c_position'].'</div><div id=con>Gender:'.$row['c_gender'].'</div><div id=con>Year:'.$row['c_Year'].'</div><div id=con>Course:'.$row['c_Course'].'</div><div id=con>Class:'.$row['c_Class'].'</div><div id=con>Partylist:'.$row['c_Partylist'].'</div>">'.$row['c_fname'].' '.$row['c_lname'].'</a>'.'<br>';
    echo "</td>";
    echo"</tr>"; 
     }
     echo"</table></center>";
    }
    ?> 
    <br></br>
    <?php
    include('voting_connect.php');
    {
    $result = mysql_query("SELECT * FROM candidates WHERE c_position='Vice President'")
    or die(mysql_error());  

    echo "<center><table id='tables' class='sortable'>";
    echo "<tr><th scope='col' abbr='' class='nobg'>&nbsp;&nbsp;</th> <th>Vice President:</th></tr>";

    while($row = mysql_fetch_array($result))
      {
    echo "<tr>";
    echo "<td scope='row' class='spec'>" . '<input name="selector1[]" type="radio" value="'.$row['c_ID'].'">' . "</td>";
    echo "<td>";
    echo '<a href=# alt=Candidate Profile rel=tooltip content="<div id=imagcon><img src='.$row['c_Location'].' class=tooltip-image/></div><div id=con>Running for:'.$row['c_position'].'</div><div id=con>Gender:'.$row['c_gender'].'</div><div id=con>Year:'.$row['c_Year'].'</div><div id=con>Course:'.$row['c_Course'].'</div><div id=con>Class:'.$row['c_Class'].'</div><div id=con>Partylist:'.$row['c_Partylist'].'</div>">'.$row['c_fname'].' '.$row['c_lname'].'</a>'.'<br>';
    echo "</td>";
    echo"</tr>"; 
     }
     echo"</table></center>";
    }
    ?> 
    <br></br>
    <?php
    include('voting_connect.php');
    {
    $result = mysql_query("SELECT * FROM candidates WHERE c_position='Secretary'")
    or die(mysql_error());  

    echo "<center><table id='tables' class='sortable'>";
    echo "<tr><th scope='col' abbr='' class='nobg'>&nbsp;&nbsp;</th> <th>Secretary:</th></tr>";

    while($row = mysql_fetch_array($result))
      {
    echo "<tr>";
    echo "<td scope='row' class='spec'>" . '<input name="selector2[]" type="radio" value="'.$row['c_ID'].'">' . "</td>";
    echo "<td>";
    echo '<a href=# alt=Candidate Profile rel=tooltip content="<div id=imagcon><img src='.$row['c_Location'].' class=tooltip-image/></div><div id=con>Running for:'.$row['c_position'].'</div><div id=con>Gender:'.$row['c_gender'].'</div><div id=con>Year:'.$row['c_Year'].'</div><div id=con>Course:'.$row['c_Course'].'</div><div id=con>Class:'.$row['c_Class'].'</div><div id=con>Partylist:'.$row['c_Partylist'].'</div>">'.$row['c_fname'].' '.$row['c_lname'].'</a>'.'<br>';
    echo "</td>";
    echo"</tr>"; 
     }
     echo"</table></center>";
    }
    ?> 
    <br />
    <br />
    <input type="submit" value="Vote!" name=submit"/>

-----CUT-----

  • 2 Contributors
  • 1 Reply
  • 586 Views
  • 3 Hours Discussion Span
  • Latest Post Latest Post by titosd

Dani AI

Generated

Short answer: tie every vote to the authenticated student ID on the server and enforce it in the database with a UNIQUE constraint. is right that the app must check whether the student has already voted, but that check must be done server-side and backed by the database (not by IP or by a client-sent field). Also move off the old mysql_* calls and use PDO or mysqli with prepared statements.

A simple schema and enforcement pattern:

Create a votes table with a UNIQUE key on (student_id, position) so the DB prevents duplicates even under concurrent requests.

CREATE TABLE votes (
  id INT AUTO_INCREMENT PRIMARY KEY,
  student_id VARCHAR(50) NOT NULL,
  position VARCHAR(50) NOT NULL,
  candidate_id INT NOT NULL,
  voted_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
  UNIQUE KEY uq_student_pos (student_id, position)
) ENGINE=InnoDB;

Server-side workflow (high level)

  • Require login; read student id from the server session (never trust a hidden form field).
  • For each position, attempt an INSERT using a prepared statement.
  • If the INSERT fails with a duplicate-key error, report "already voted" for that position.
  • Rely on the UNIQUE constraint to avoid race conditions instead of a separate SELECT-then-INSERT check.

Example (PDO) pattern:

<?php
session_start();
$student_id = $_SESSION['student_id'] ?? null;
if (!$student_id) exit; // reject

$sql = "INSERT INTO votes (student_id, position, candidate_id) VALUES (:sid,:pos,:cid)";
$stmt = $pdo->prepare($sql);
try {
  $stmt->execute([':sid'=>$student_id, ':pos'=>$position, ':cid'=>$candidate_id]);
  // success
} catch (PDOException $e) {
  if (isset($e->errorInfo[1]) && $e->errorInfo[1] == 1062) {
    // duplicate -> already voted
  } else { throw $e; }
}
?>

Practical tips and cautions

  • Use HTTPS, parameterized queries, CSRF tokens and server-side validation.
  • Log attempts (timestamp, student_id, IP) for audit and fraud detection.
  • If ballots must be anonymous, separate the audit record (who voted) from the stored ballot (separate tables and/or a randomized ballot id).
  • If duplicates appear, verify the UNIQUE index exists (ALTER TABLE ... ADD UNIQUE ...) and that the table uses InnoDB so transactions behave correctly.
Member Avatar for titosd

You can use student id for this problem

before submit his vote check if this student id exist in the voting table, if no add it else give him a msg

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.