I am creating a guestbook, and i want to know of any other ways to prevent flooding, i dont want to use cookies, is there a way to do it using sessions?

What you want to do is just log the user's IP to the database, along with the time of their posting. Then once someone tries to post again, you see if it's the same person -- if it is the same person and they're within the flood-time limit, then you deny them.

Here's one example I used to use:

CREATE TABLE flood_protect (
    id INT NOT NULL AUTO_INCREMENT,
    ip VARCHAR(100) NOT NULL,
    ip_alt VARCHAR(100) NOT NULL,
    time INT NOT NULL,
    PRIMARY KEY (id)
);

PHP Code:

<?php
$flood_limit = 300; // flood limit, in seconds. (300 = 5 mins)

////////////////////

mysql_connect('localhost', 'root', '');
mysql_select_db('my_db');
mysql_query("DELETE FROM flood_protect WHERE time < " . (time() - $flood_limit)) or die(mysql_error());
// ^ you can actually get rid of this line, but the IP records would
// start to build up in the database. If you have some sort of
// cron system, you can just empty it every once and a while
// and save the extra query.

////////////////////

$ip = getUserIP();
$ip_alt = getUserIP('alt');

$query = mysql_query("SELECT COUNT(*) FROM flood_protect WHERE ip = '$ip' AND ip_alt = '$ip_alt' AND time >= " . (time() - $flood_limit)) or die(mysql_error());
$count = mysql_fetch_row($query);

if($count === false)
    $count = 0;
else
    $count = $count[0];

if($count > 0)
    die('Sorry, you cannot post again due to flood protection. Please wait ' . $flood_limit / 60 . ' minutes.');

mysql_query("INSERT INTO flood_protect (ip, ip_alt, time) VALUES ('$ip', '$ip_alt', " . time() . ")") or die(mysql_error());

////////////////////

function getUserIP($what = '')
{
    if($what == 'alt')
    {
        if(isset($_SERVER['HTTP_CLIENT_IP']))
            return $_SERVER['HTTP_CLIENT_IP'];

        elseif(isset($_SERVER['HTTP_X_FORWARDED_FOR']) && preg_match_all('#\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}#s', $_SERVER['HTTP_X_FORWARDED_FOR'], $matches))
        {
            foreach($matches[0] AS $ip)
            {
                if (!preg_match('#^(10|172\.16|192\.168)\.#', $ip))
                    return $ip;
            }
        }

        elseif(isset($_SERVER['HTTP_FROM']))
            return $_SERVER['HTTP_FROM'];
    }

    return $_SERVER['REMOTE_ADDR'];
}

?>