This happens many times throughout the day and we have yet to find a way to prevent it.

I tried this and included an explanation beside the question to explain why we were doing it. It all sounds too simple but it has worked for me so far.

>>>"what is four plus three"?

You can also use randomly generated numbers to sum that you pass to the next page for validation ;)

eelixduppy, I have a session variable that I set and pass on the form and then verify on the processing page, but somehow, the generic submissions are bypassing this...

Javascript validation is there for the convenience of the user. Server-side validation is for the protection of the server. Don't skip the latter.

Check for minimum and maximum form values.
Check for type of values (numeric, string, url).
Clean them before using it for database query.
Do not use same table attributes as that of form fields.
Unset session variables when not required.
When using sessions, add remote ip check for session hijacking attacks.

I do not guarantee that this will permanently resolve your problem but it will definitely stop 90% of the form attacks.

Milan

I have been utilizing Javascript as you said, but my reasoning was more to avoid unnecessary round trips to the server.

milanmk... what do you mean by "Do not use same table attributes as that of form fields."

Thanks.