Multiple ratings using Jquery with single IP address

Question

I'm in the process of developing a simple web application that provides ratings. A user can vote only ONCE with their IP address. However, the problem is that there are multiple things to rate but whenever a user enters his rating into one field, he cannot enter rating into other ratings. I want my PHP file to know that I only want to validate IP address for one rating and the user can rate other stuff.

Here's my JQuery code:

<h1>Demo 1</h1>
<script>
    $(document).ready(function () {
        $("#demo1 .stars").click(function () {
            var id = 1;

            $.post('rating.php', {rate:$(this).val()}, function(d) {
                if (d>0) {
                    alert('You already rated');
                } else {
                    alert('Thanks For Rating');
                }
            });

            $(this).attr("checked");
        });
    });
</script>
<fieldset id='demo1' class="rating">
    <input class="stars" type="radio" id="star10" name="rating" value="10" />
    <label class = "full" for="star10" title="Very nice - 10/10"></label>
    <input class="stars" type="radio" id="star9" name="rating" value="9" />
    <label class = "full" for="star9" title="Great - 9/10"></label>
    <input class="stars" type="radio" id="star8" name="rating" value="8" />
    <label class = "full" for="star8" title="Great - 8/10"></label>
    <input class="stars" type="radio" id="star7" name="rating" value="7" />
    <label class = "full" for="star7" title="Good - 7/10"></label>
    <input class="stars" type="radio" id="star6" name="rating" value="6" />
    <label class = "full" for="star6" title="Good - 6/10"></label>
    <input class="stars" type="radio" id="star5" name="rating" value="5" />
    <label class = "full" for="star5" title="Meh - 5/10"></label>
    <input class="stars" type="radio" id="star4" name="rating" value="4" />
    <label class = "full" for="star4" title="Meh - 4/10"></label>
    <input class="stars" type="radio" id="star3" name="rating" value="3" />
    <label class = "full" for="star3" title="Sucks - 3/10"></label>
    <input class="stars" type="radio" id="star2" name="rating" value="2" />
    <label class = "full" for="star2" title="Sucks - 2/10"></label>
    <input class="stars" type="radio" id="star1" name="rating" value="1" />
    <label class = "full" for="star1" title="Sucks - 1/10"></label>
</fieldset>

There are multiple such fieldsets with id = demo2, demo3, etc. I want some unique identifier or variable for each demo.

This is how my PHP processes the request and sends it to the database:

   if (isset($_POST['rate']) && !empty($_POST['rate'])) {

    $rate = $conn->real_escape_string($_POST['rate']);
    $sql = "SELECT `id` FROM `tbl_rating` WHERE `user_id`='" . $ipaddress . "'";
    $result = $conn->query($sql);
    $row = $result->fetch_assoc();

    if ($result->num_rows > 0) {
        echo $row['id'];
    } else {
        $sql = "INSERT INTO `tbl_rating` ( `rate`, `user_id`) VALUES ('" . $rate . "', '" . $ipaddress . "'); ";
        if (mysqli_query($conn, $sql)) {
        echo "0";
        }
    }
}

I could think of just one solution which can trigger a flag on click to 1 for demo1, 2 for demo2, 3 for demo3, etc.

Answer 1

If you can rate more than one thing you should update your tbl_rating adding at least one column and then perform the select and insert with that column (let's say rated_field).

if (isset($_POST['rate']) && !empty($_POST['rate']) && isset($_POST['rateField']) && !empty($_POST['rateField'])) {
    $rate = $conn->real_escape_string($_POST['rate']);
    $rateField = $conn->real_escape_string($_POST['rateField']);
    $sql = "SELECT `id` FROM `tbl_rating` WHERE `user_id` = '" . $ipaddress . "' AND `rated_field` = '" . $ratedField . "' LIMIT 1";
    $result = $conn->query($sql);
    if ($result->num_rows > 0) {
        $row = $result->fetch_assoc();
        echo $row['id'];
    } else {
        $sql = "INSERT INTO `tbl_rating` ( `rate`, `rated_field`, `user_id`) VALUES ('" . $rate . "', '" . $ratedField . "', '" . $ipaddress . "'); ";
        if (mysqli_query($conn, $sql)) {
            echo "0";
        }
    }
}

then send the fieldset id as rate_field value:

$(document).ready(function () {
    $(".stars").click(function () {
        var id = 1;

        $.post('rating.php', {rate:$(this).val(), rateField:$(this).parent().attr('id')}, function(d) {
            if (d>0) {
                alert('You already rated');
            } else {
                alert('Thanks For Rating');
            }
        });

        $(this).attr("checked");
    });
});

It will work.

Also, consider using a method to try to get the real ip.