The biggest hurdle you will have is identifying unique users. The best way is to force registration and login. That's a discussion for another topic.
Regardless of that your table needs to have 2 other columns.
QuestionID
MediumINT (15), Unsigned, Primary Index, Auto Increment. This should be the very first column.
QuestionVoters
Text, NULL. This field will hold a json encoded array of userid's that have voted. array('123', '38', '27', '15')
In your While()
loop check if the user's ID is in the QuestionVoters
array.
If it exists, then don't give them a voting action. Otherwise build out a form using a button to submit to a processing page.
<?php
// Need to assign the user's ID to a variable ($userID) to pass to the form.
$userID = '123'; // this needs to be handled on your end.
// updated sql to include Id and voters
$sql = "SELECT QuestionID, QuestionHeader, QuestionText, QuestionVotes, QuestionVoters FROM question ORDER BY QuestionVotes DESC LIMIT 3";
while($row = $result->fetch_assoc()) {
$voters = json_decode($row['QuestionVoters'], true); // array of userid's that have voted
IF (in_array($userID, $voters)) {
// user has voted
echo "\n
<div class=\"col-md-4\">
<h2>". $row["QuestionHeader"]. "</h2>
<p>". $row["QuestionText"]. "</p>
<p>" . $row["QuestionVotes"] . "</p>
</div>";
}ELSE{
// user has not voted
echo "\n
<div class=\"col-md-4\">
<form action=\"vote_processing.php\" name=\"voting\" method=\"post\">
<input type=\"hidden\" name=\"qid\" value=\"".$row['QuestionID']."\" />
<input type=\"hidden\" name=\"userid\" value=\"".$userID."\" />
<h2>". $row["QuestionHeader"]. "</h2>
<p>". $row["QuestionText"]. "</p>
<p><button type=\"submit\" value=\"Submit\">" . $row["QuestionVotes"] . "</button></p>
</form>
</div>";
}
}
?>
vote_processing.php (example)
<?php
IF (isset($_POST['qid'])) {
$qid = htmlspecialchars(strip_tags(trim($_POST['qid']))); // basic sanitization
$userid = htmlspecialchars(strip_tags(trim($_POST['userid']))); // basic sanitization
IF ( (is_int($qid)) && (is_int($userid)) ) { // validate that both are integers
// db connection
$connection = mysqli_connect('localhost', 'root', '', 'test');
mysqli_set_charset($connection, 'utf8');
if (!$connection) {
die("Database connection failed: " . mysqli_error());
}
// Get voters array
$sql = "SELECT QuestionVoters FROM question WHERE QuestionID = '".$qid."'";
$result = $connection->query($sql);
if ($result->num_rows > 0) {
while($row = $result->fetch_assoc()) {
IF (!empty($row['QuestionVoters'])) {
// decode users array
$voters = json_decode($row['QuestionVoters'], true);
}ELSE{
$voters = array(); // create array
}
}
mysqli_free_result($result);
// re-validate the userID "is not" in array
IF (!in_array($userid, $voters)) { // note the ! [meaning NOT].
$voters[] = $userid; // add userid to voters array
$qvoters = json_encode($voters); // encode voters array
// update vote
$sql_upd = "UPDATE question SET QuestionVotes = QuestionVotes + 1, QuestionVoters = $qvoters WHERE QuestionID = '".$qid."'";
$upd_result = $connection->query($sql_upd);
}
}
mysqli_close($connection);
}
}
// redirct back to previous page
?>