Banlists, the best method?

I wasn't sure which board to post in, but networking seemed best.

Here is my problem:

I'm running a small website (PHP/MySql), where others can register themselves for an event. Eveyr here and there, someone posts something I would rather not show up on the front page (it is supposed to be a clean website). Although usually people stop after the first time, but I want to be prepared.

I wrote a simple system to let me block an IP address, but obviously IP addrsesses change, can be changed, etc.

What is the best method of banning a computer? (Preferably PHP friendly)

wow, that's pretty hardcore. I don't know php but see if there's a way to get specific data about a computer and check that. (If there is, I'm not longer browsing the internet) I'd say most people don't use dialup anymore so checking for IP is probably your only and best bet.

the only method, unfortunately, is by using the IP address. There is no way to know a specific computer. Unfortunately IPs are dynamic and a lot of times if you ban an IP (for instance an AOL address), you end up banning hundreds of people. Unfortunately, there is no other good way, that's just a limitation of the web we have to live with.

I'd suggest just using IP addresses, because a lot of people use DSL or cable and they tend to give you an IP address that rarely changes, so people will usually just give up vandalizing your site after a while. Most of the message boards that I deal with take this approach.

Make them register with an email address, then ban that account access. Or if you don't want to code it all yourself, find a free forum software that has a SSI and use their user management.

http://www.simplemachines.org is one. Btw moving this to the tech board

echo Thantos

there's usually a way around every ban available, besides a blanket ban of everybody (but for obvious reasons, that's useless)

on the other end, partial blanket bans may be useful. Most ISP's shell out their IP's based on region, and each ISP has a certain range of IP's they can give out. for example, if you wanted to ban everybody trying to access you from langley air force base in virginia, you could block 131.6.*

of course, they could have more reserved IP's in another block somewhere, but they're only likely to have a few blocks at most.

with subnet bans (like the example), you always risk banning people you don't want to ban. Imagine, if you will, you have a regular from langley AFB, and one of his friends finds your site and decides to spam. You want to avoid banning your regular. IMO, Thantos' method is best. Most people will give up and go somewhere else rather than create a bunch of email addresses to spam your site. it's a game of patience, and banning an account is ALOT less work than creating a new one.

if it gets bad enough, you could always switch to manual verification for a little while too. for example, if you notice the same person keeps switching IP's and email addresses and creating a new account (happens sometimes in "forum wars"), you can close down automatic registration for a while, then open them back up to manual registration and have your mods/admins write semi-personal emails to everybody that tries to register and make that person reply back, rather than just cliking a link. then that mod/admin manually changes the status of that user.

If it is a violation that involves illegal content ( ie pornographic material on family friendly site ) then report the abuser to thier isp.
requesting either updating of offenders ip every time they get new ip, or whatever action the isp feels is warranted.
( often, in cases of porn, that is a loss of connectivity )

cookies plus IP should work in most cases

Quote:

---

Originally Posted by Jaqui

If it is a violation that involves illegal content ( ie pornographic material on family friendly site ) then report the abuser to thier isp.
requesting either updating of offenders ip every time they get new ip, or whatever action the isp feels is warranted.
( often, in cases of porn, that is a loss of connectivity )

---

that's often overkill... what happens when a businessman's 14 year old decides to "hax0r" your site... now that legit guy gets hit with the consequences. However, if you just ban his IP/account, then the businessman is usually not going to be affected.

you're talking about potentially getting somebody fired from their job because their stupid kid thinks he's a "l33t hax0r" because he can change a wiki. If you don't see how it could get somebody fired, think about it this way: a good amount of people use an internet account provided by the company they work for as a primary internet account.