You need to identify a unique identifier.
It can't be the UID
as schlicki mentioned in the comment.
You can add an email field. But if you don't add validation to this, people can just make up something up.
If you're going to add email + validation, would an account on the site be worth it?
Another option is a combination that identifier the browser as unique. You can look into https://github.com/Valve/fingerprintjs2. You can take all those properties and hash all of those together. That should give you a good identifier.
THIS CAN BE FOOLED. BY DEFAULT THEY WILL BE ABLE TO SUBMIT A FORM PER EACH BROWSER ON EACH DEVICE THEY HAVE.
If it doesn't have to be super strict, it would work.
This link, https://panopticlick.eff.org/ may have more information on what you're exploiting.
What I would do,
- Generate a hash based on all the properties from
fingerprintjs2
.
- Take that hash and add it to a hidden field
- On submit, you can check the value
- Validate that it's not empty.
- Check the value in the database (you'll need a table for this)
- If it is on your table,
- Check when was the last time this was submitted
- Apply your rules.
- If it can be submitted again, perfect.
- If it can't be submitted again, show a message. You can show how much time they need to wait for the next submission.
- If it's not on your table,
- Add the value to the database
- Allow the submission through
That's the logic that you would have to apply.