I have some code that is helping to protect some online surveys. The surveys have an incentive in the form of an Amazon voucher or cash (which is manually/semi-automatically distributed post-survey) so as you can imagine, we get a lot of people attempting to get multiple vouchers, or undesirable respondents mainly from China.

Of course the main way to prevent this, is to send out unique links to a set of pre-recruited people, however this isn't always an option and hence the need for some kind of protection.

Here is the code, I've removed 2 SQL insert queries to reduce the size of this post:

```
$countryCode = sanitise($_SERVER["HTTP_CF_IPCOUNTRY"]);
$allowedCountries = getAllowedCountries($projectID); // array('GB', 'US', 'SE');

if(in_array($countryCode, $allowedCountries)) {

    // Count records with matching ip for this project, >=1 TRUE, 0 FALSE
    $isBlocked = checkForBlockedIP($projectID, $ip);

    if($isBlocked == TRUE) {

        header("Location: error.php?blocked");

    } else {

        // Count records with matching ip for this project, >=1 TRUE, 0 FALSE
        $isDuplicate = checkForDuplicateResponse($projectID, $ip);

        if ($isDuplicate == TRUE) {

            //<Removed>
            // Store identifying data into dup_attempts table
            // and block ip from further attempts

            header("Location: error.php?duplicate");

        } else {

            // Create redirect link and send user to it

            $redirectLink = $projectLink . $userID;
            header("refresh:3; url=" . $redirectLink . "");

        }

    }

}

```

I'm posting this here, because I'm not a professional developer and I don't know if I'm taking the right approach here. Perhaps my approach as a whole is wrong.

I'm allowing only certain countries to participate, checking for a duplicate IP (per project) and if one is found, then I'm storing it in a table for duplicate attempts and adding the IP to a blacklist for that project.