title: Using a randomly generated token for flood control
body: <p>Basic setup of my site is: user enters a message on the homepage, hits enter and the message is sent though a AJAX request to a file called <code>like.php</code> where it echo's a link that gets sent back to the user.</p>
  
  <p>I have made the input disable when the user presses enter, but there's nothing stopping the user from just constantly flooding <code>like.php</code> with POST request and filling up my database.</p>
  
  <p>Someone here on SO told me to use a token system but didn't mention how. I've seen this being done before and from what I know it is effective.</p>
  
  <p>The only problem I have is how will <code>like.php</code> know it's a valid token? My code is this at the moment:</p>
  
  <pre><code>$token = md5(rand(0, 9999) * 1000000);
  </code></pre>
  
  <p>and the markup:</p>
  
  <pre><code>&lt;input type="hidden" name="token" value="&lt;?php echo $token ?&gt;" /&gt;
  </code></pre>
  
  <p>Which will send the token to <code>like.php</code> through POST. But how will <code>like.php</code> know that this is a valid token? Should I instead token something that's linked to the user? Like their IP address? Or perhaps token the current minute and check that it's the same minute in <code>like.php</code>...</p>
  
  <p>Any help on this amtter would be greatly appreciated, thanks. :)</p>