How to prevent multiple pages? - php

Question

I have a site that gives to the user 1000 points for every timer (30 min).
When the user clicks on the button "Start timer" the timer count down 30 min, when the timer is over button appears that gives the user 1000 points.
My problem is: the users can open this page a lot of times and get a lot of points for 30 min instead of 1000.
Timer script:
<script type="text/javascript">
var interval;
var minutes = 30;
var seconds = 0;
var a;
var audio = new Audio('timer.mp3');
function AutoRefresh( t ) {
setTimeout("location.reload(true);", t);
}
function countdown(element) {
interval = setInterval(function () {
var el = document.getElementById(element);
if (seconds == 0) {
if (minutes == 0) {
el.innerHTML = '<h2>The Timer is over!</h2>';
el.innerHTML += '<form action="timer.php" method="post" onsubmit="hide();" id="hide"><input type="submit" value="Get 1000 points" name="update" class="newslesubmit" style="width: 100%; font-size: 16px; box-shadow: inset 0px 1px 2px 0px rgba(238,238,238,1);" /></form>';
audio.play();
AutoRefresh(600000);
clearInterval(interval);
return;
} else {
minutes--;
seconds = 59;
}
}
if (minutes > 0) {
var minute_text = minutes + (minutes > 1 ? ' :' : ' :');
} else {
var minute_text = '';
}
if(minutes < 10) {
var minute_text = '0' + minutes + ' :';
}
var second_text = seconds > 1 ? '' : '';
if(seconds < 10) {
var a = ' 0';
} else {
var a = ' ';
}
el.innerHTML = minute_text + a + seconds + ' ' + second_text + '';
seconds--;
}, 1000);
}
function start() {
if (!interval) {
countdown('countdown');
}
};
function hide() {
var hide = document.getElementById('hide');
hide.style.display='none';
}
</script>
The PHP and the HTML:
<?php
if(isset($_POST['update'])) {
$req = mysql_query('SELECT last_earn FROM users WHERE id="'.mysql_real_escape_string($_SESSION['userid']).'"');
$dnn = mysql_fetch_array($req);
$a = $dnn['last_earn'] + 3000;
if($a <= time()){
$date = date('Y-m-d H:i:s');
mysql_query('UPDATE users SET last_earn="'.$date.'" WHERE id="'.mysql_real_escape_string($_SESSION['userid']).'"');
mysql_query('UPDATE users SET earn=earn+1000 WHERE id="'.mysql_real_escape_string($_SESSION['userid']).'"');
echo "<meta http-equiv='refresh' content='0;URL=index.php' />";
}
}
?>
<input type="button" value="Start timer" onclick="start(); this.style.display='none'" class="newslesubmit" style="width: 100%; font-size: 16px; box-shadow: inset 0px 1px 2px 0px rgba(238,238,238,1);" />
<div id="countdown" style="font-size: 40px; font-weight: bold;"></div>

Answer 1

Whenever you give the user points set a column in the database for "Points last received at". Simply save it as a timestamp or datetime. Then, when updating with points, only update if they last received their points more than 30min ago :D No user can ever cheat it and get more than is possible.