在我的网站中，我有用户以电子邮件作为用户名注册

如果我试图手动添加一个新用户，而我使用的用户名（即邮件）已经存在，WP会投诉并告诉我该用户名已经注册

如果通过下面的代码以编程方式执行此操作，我会处理此问题并阻止注册

然而，我猜有一个用户多次单击表单提交按钮，成功地在我的WP用户数据库中复制了完全相同的用户

问题是，这怎么可能？

我该如何防止这种情况？

从评论中，换言之，重新表述问题：If I want to replicate this, how can I do this?

到目前为止，唯一有意义的解释是，我只能通过重新创建一个种族条件（frontend、postman、curl等等）来复制它

我不确定是否有办法阻止它（我想这就像防止DOS攻击一样）

我使用的代码是：

    public function register_user($request = null)
    {
        $response = array();
        $parameters = $request->get_json_params();
        $email = sanitize_text_field($parameters[\'email\']);
        $password = sanitize_text_field($parameters[\'password\']);
        $domain = $_SERVER[\'HTTP_REFERER\'];
        $uri = $_SERVER[\'REQUEST_URI\'];

        $role = \'subscriber\';
        $error = new WP_Error();

        if (empty($email)) {
            $error->add(...);
            return $error;
        }
        if (!is_email($email)) {
            $error->add(...);
            return $error;
        }
        if (empty($password)) {
            $error->add(...);
            return $error;
        }

        $user_id = username_exists($email);
        if (!$user_id && email_exists($email) == false) {
            $user_id = wp_create_user($email, $password, $email);

            if (!is_wp_error($user_id)) {
                $user = get_user_by(\'id\', $user_id);
                $user->set_role($role);
                $response[\'code\'] = 200;
                $response[\'message\'] = __("User \'" . $user_id . "\' ok ", "...");
            } else {
                return $user_id;
            }
        } else if ($user_id) {
            $error->add(...);
            return $error;
        }

        return new WP_REST_Response($response, 200);
    }

从注释中编辑，包括前端代码

        <button type="text" value="" onClick={register}>
          <div>...</div>
        </button>

  const register = async e => {
    e.stopPropagation()
    if (registering === \'working\') return
    setRegistering(\'working\')

    let id = input_id.current.value.trim()
    let pass = input_pass.current.value
    let pass2 = input_pass2.current.value

    const success = pass === pass2 ? await auth.signup(id, pass, feedback) : \'not_equal_passwords\'
    setRegistering(success)
    if (success === \'yes\') navigate(\'/welcome\')
  }

  const signup = async (email, password) => {
    const register = `${domain}${website}/wp-json/.../register`
    const request = get_request(\'POST\')
    const expression = /^([a-zA-Z0-9_.-])+@(([a-zA-Z0-9-])+.)+([a-zA-Z0-9]{2,4})+$/

    let success = password ? (email ? \'\' : \'no_id\') : \'no_pass\'
    success = expression.test(String(email).toLowerCase()) ? \'\' : \'no_mail\'

    if (!success) {
      request.body = JSON.stringify({ email: email, password: password })
      const response = await get_response(register, request, 5, 4000, \'json\')
      success = response.code === \'user_exist\' ? \'user_exist\' : \'yes\'
    }

    return success
  }

const get_response = async (url, request, times, time = 2000, json) => {
  const rq = request || get_request(\'GET\')
  let response = await Promise.race([fetch(url, rq), wait(time)])
  let counter = 0

  for (const _ of [...Array(times)]) {
    if (counter >= times || response !== \'timed\') break
    response = await Promise.race([fetch(url, request), wait(time)])
    counter++
  }

  if (response === \'timed\') return
  return json ? await response.json() : response
}