Forum Moderators: phranque
Anyway, after a bit of research I've managed to stop it by luring it into a trap with a bit of bait. The spam has finally stopped. Here's how I did it:
- Add a new field to the form using a typical name - something like:
<input name="email2" type="text" size="45" id="email2" />
- Then wrap it in a hidden layer so that people using web browsers can't see it, eg:
<div style="visibility:hidden">
<input name="email2" type="text" size="45" id="email2" />
</div>
- Then add some logic to your form handling so that the contact form is not actually submitted if there's any data in the invisible field, eg:
$email2 = stripslashes($_POST["email2"]);
if (!empty($email2)) {
header("location: pretend_that_email_sent.php");
exit();
}
Because the robots don't use browsers, they don't realise the field is hidden and they fall into the trap of adding data to the field. Once they do that, you know it's spam and can stop the data being submitted.
It doesn't rely on JavaScript and your normal users won't even know it's there. Worked for me :)
Just add a log so you can enjoy yourself by looking at the "kills Stat"
[edited by: Raymond at 7:12 am (utc) on Jan. 25, 2007]
You know how forms have all the text fields to fill out? In rogoff's example, he/she is just putting a "hidden" text field in the form (a hidden field will not be displayed as a browser). Since spam bots aren't smart enough to know that a field is hidden or not (they just care if it's there), they'll fill in some spam values and try to send the form.
In your form handler, rogoff is suggesting you put some code that checks if this hidden value is filled in. If it is, then you've got a dumb spam bot trying to send you garbage. If it's not filled in, then you have a valid user, or a smart bot ;)
I see the new field goes into my form
<div style="visibility:hidden">
<input name="email2" type="text" size="45" id="email2" />
</div>
That's the easy part.
Where does this go?
$email2 = stripslashes($_POST["email2"]);
if (!empty($email2)) {
header("location: pretend_that_email_sent.php");
exit();
}
If I put it into the text file that handles my form, it just gets spat out in my form, if I put it into the form, it jsut gets spat out on the html page.
I am obviously missing something here.
$email2 = stripslashes($_POST["email2"]);
if (!empty($email2)) {
header("location: pretend_that_email_sent.php");
exit();
}
This is PHP code, and is used on a .php page.
