MySQLi Prepared Statement to compare current time with stored datetime? - php

Question

I have HTML form which I don't want users to be able to use more then once per day.
So far iv'e figured out what I should do but I'm not really sure how.
When a user submits the form I store their "IP" (column ip) aswell as the current time (column submitTime) and the current time + 23 hours (column releaseTime):
$submitDate = date("Y-m-d H:i:s");
$currentTime = time();
$releaseTime = date("Y-m-d H:i:s", strtotime('+23 hour', $currentTime));
But what I dont know is how can I proceed? I feel like I'm stuck.
I know I should compare $currentTime with the releaseTime I get from MySQL, but how?
So far I got this code (see the comment lines):
$ip = $_SERVER['REMOTE_ADDR'];
$stmt1 = $conn->prepare('SELECT * FROM IPlock WHERE ip=?') or die('Couldn\'t check the IP');
$stmt1->bind_param("s", $ip);
$stmt1->execute();
$stmt1->store_result();
$countRows = $stmt1->num_rows;
$stmt1->close();
if ($countRows > 0) {
/*
Code to check for how long the IP has existed in MySQL
If it has existed for more then 23 hours, remove it and proceed.
else abort (since its blacklisted for another x hours)
*/
}
I know I should not use the IP to identify an user since some users share their IP, but in this case I really have to.

Answer 1

You can use this to check if one has submitted the form in the last 24 hours.
SELECT * FROM IPlock WHERE `ip`=? AND `submitTime` > NOW() - INTERVAL 24 HOUR;
If IP has not submitted in the past 24 hours, no rows will be returned.
EDIT:
In addition to that, there's no need to use PHP date() function, you can do your insert like
INSERT INTO IPlock (`ip`, `submitTime`) VALUES ('127.0.0.1', NOW());
Note that CURRENT_TIMESTAMP will work just as well.

Answer 2

In fact, your problem is different from what you asked.
To compare a datetime value of mysql format you just have to compare it - not a big deal.
The real question is how to get the value for comparison (with your current code you can't) and what to do if you found that the record is outdated.
So, first you need to fetch the datetime value:
$stmt1 = $conn->prepare('SELECT releaseTime FROM IPlock WHERE ip=?');//never use die()
$stmt1->bind_param("s", $_SERVER['REMOTE_ADDR']);
$stmt1->execute();
$stmt1->store_result();
$stmt1->bind_result($releaseTime);
$stmt1->fetch();
and now you can start checking the date. Note that you don't need the num rows here.
if ($releaseTime > date("Y-m-d H:i:s")) {
/*
Code to check for how long the IP has existed in MySQL
If it has existed for more then 23 hours, remove it and proceed.
else abort (since its blacklisted for another x hours)
*/
}