The code should be correct, actually. The pages column is more of an informational field and doesn't really do the DoS checking. We are checking how many urltokens exist for a specific IP address because a DoS attack will often generate multiple urltokens for one IP. If it was not a DoS attack we should not get excessive urltokens for that IP from normal browsing activity. So we count unique urltokens to make sure that IP is not suspect.

I think there is an error in the code used for the DoS security article. When checking for excessive hits, the query uses the urltoken column from the database. This column will only exist once for each session. The pages column is what gets incremented for multiple page views. Please correct me if I am wrong...