prevent password (account) sharing

[dabean]

You could achieve (a) by firstly modifying the session table to contain a field called “active”. Then with the new field added it becomes as simple as setting active to 1 every time a new session is created and most importantly setting “active” of all other sessions for that userid that have a different IP address to 0. e.g. (UPDATE session SET active =0 WHERE userid=’$bbuserinfo[userid]’ AND host!=’$REMOTE_ADDR’)

Now for the really clever part when a user requests anything you just check to see if the session they are using has been deactivated, if it’s been deactivated you’ve caught simultaneous browsing from different IP addresses.

To achieve (b) Create two new tables (master/detail relationship) called say abuseevent and abusedetail. The reason for using a master detail relationship is it allows for any number of simultaneous sessions.
In abuseevent record the actual abuse e.g. userid, time & abuseid (auto increment)
In abusedetail record each of the IP addresses that where active at the time e.g. abuseid, IP address & abusedetailid (auto increment)

I’ll leave part (c) for someone else to figure out as the solution is extremely involved, personally I would write the code necessary to do parts (a), (b) before even thinking about all extra logic needed for part (c).