SharePoint Stack Exchange is a question and answer site for SharePoint enthusiasts. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm creating a Site Definition that will have a Stack Overflow like Q/A system.

I'm hung up on the upvote/downvote system.

I see a number of ways to do this, but what I think works best is to have a Profiles list, and store the vote state of each user in a text column, in a sort of JSON like format.


0 being a downvote, 1 being an upvote. The number indicates the ID of the List item being voted upon.

The reason I don't want to have an Upvote/Downvote list, is this could end up being a SUBSTANTIAL list to create, call and organize. This way, when a user loads the page, I get all of his vote history in a parseable string and can search for matches on the page to indicate his voting history.

What I'm hung up on is the vulnerability of exposing the list to AJAX calls. I can imagine a situation where a post gets voted into prominence by a user adding {14509:1} to as many profiles as possible.

I understand that even if I don't build the voting system around AJAX, a sophisticated user could write that kind of code and inject it anyways.

Is there a way to lock down a list to all users, and put the upvote/downvote code in an update panel that still executes server side?

share|improve this question
up vote 1 down vote accepted

How sophisticated are your users? Realistically these sorts of systems are always going to be vulnerable to fixing/gaming. Also storing the voting history against each user doesn't sound very scalable to me. You will end up doing an awful lot of processing to generate any page.

Why not keep the voting essentially anonymous but keep in ASP.NET cache a value which tracks the fact a user has already voted for that particular page. Looking up the user/page combo in cache is quick and light and would prevent multiple calls.

It would likely disappear from cache after a while, say until next app pool reset but then the user would need to repeatedly call every day for a few days to make any sort of difference. Then you just need to track a vote score on the page itself. Much simpler.

share|improve this answer
It's hard to say. The solution will be sold as a portion of a product, so it will be deployed to an unpredictable and disparate user base. – Wesley Jul 2 '12 at 16:05

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.