I have a question and answer website like SO. I have some limitations on some of facilities. For example an user cannot vote who has less than 20 reputation. Or an user cannot close a question until earning at least 200 reputation.

Ok well, there is also somethings which don't have any limitation, like writing an answer for questions. In this case, a bad user can write multiple irrelevant answers for multiple questions and makes my database huge with useless information.

So I guess I need to check something before inserting a new answer, Am I right? Or anyway, how can I manage my website's inputs? As I mentioned, in my current algorithm, a bad user (like a spammer or hacker) can simply enter lots of useless data in my database, and then maybe I understand it after 1 day (which is too late) which in this case, it takes some times to block him and remove all his data.

In conclusion, I like to know, (for example), how a website like SO handle that? Do I need a separated query before inserting a new answer for checking? Or what?

Note: I use PHP (for server-side codes) and MySQL (for database codes).

1 Answer 1


Use rate-limiting and only allow X questions posted within Y time. That should slow down any attacker and let humans deal with the spam (through downvotes or flags for example).

Every time the user tries to post a question, query your database for their last question and check that the current time is greater than that question's post time + the minimum required delay between two posts (on some Stack Exchange sites I believe it's 30 minutes).

Depending on your performance requirements you could de-normalize your database a bit and keep the last question's time directly in the user's model - that will mean you have to update their model each time they post but saves you a query of their questions since all the info you'll need will be in their user model which you have queried anyway (your framework most likely does that for you as a side-effect of checking whether they're logged in).

You can also use Redis or Memcached to cache the models to improve performance even more.

Finally if you're worried only about automated spam but not manual spam, you can present a captcha instead of completely preventing them from posting if they attempt to post too frequently.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .