Message form spam - not injection

Form recipients getting tons of spam

[louponne]

Hello fellow spam-haters,

On my original php form message form script, I checked the referrer to avoid the form getting hijacked, like so:

 // Get the referring URL
$referer = $_SERVER['HTTP_REFERER'];
 // Get the URL of this page
 $this_url = "http://".$_SERVER['HTTP_HOST'].$_SERVER["REQUEST_URI"];
 // If the referring URL and the URL of this page don't match then don't send the email.
 if ($referer!= $this_url) {
 echo "Please go away.";
 }
 else {
.........
mail($dest,$sujet,$text,$headers);
 }

Then, I had two problems - one was mail injection hacks, but also site visitors with Norton Firewall that somehow kept my script from being able to gather the referrer. So that test was actually keeping certain site visitors from being able to use the form.

So I set up a mail injection hack stopper:

// hard-code this form's input variable names
$input_vars = array('name','telephone','address','town','email','message');
// check each input variable for injection attempts and kill the process if we find one
foreach($input_vars as $field){
$input = $_POST[$field];
if (((eregi("\r", $input) ¦¦ eregi("\n", $input)) && $field == 'email') ¦¦ eregi("%0a", $input) ¦¦ eregi("%0d", $input) ¦¦ eregi("Content-Type:", $input) ¦¦ eregi("bcc:", $input) ¦¦ eregi("to:", $input) ¦¦ eregi("cc:", $input)) {
die("##########"); // end the process if injection
} 
}

So far, so good.

But now, it's the recipient of the form that's getting hit with tons of spam being sent via the form :(

This is a very public site, so I can't use a distorted image of letters that the user needs to type in.

ARe there any solutions here? I've done a good deal of searching and found lots about mail injection, but not any way to solve my "form hijacked, sent to recipients" problem.

What a drag to need to spend time on this sort of thing!

[Romeo]

If the spam sending is done by automated script bots sweeping over 1000 different forms like yours, a quick solution may be to just move the original form to a new name like feedback123.php, and create a new file under the old name feedback.php but with stripped content "this was our feedback form" and no forms functionality at all.

As long as the automated spam scripts get a success-code 200 from the webserver on their access on the old file, it may take weeks or months for clueless script kiddies to find out about your move.

This will not work, though, if an "I-hate-your-site" troll is after you personally ...

Kind regards,
R.

[louponne]

Thanks Romeo - I had indeed thought of moving the file. But I'd really like to find a robust means to kick these folks out of the script!

[le_gber]

how about checking that the data is in the format you desire.

ie. make sure the email address is a real email address, filter the phone number to be only numbers, limit the amount of text in your message box etc...

You could also change the name of the fields - instead of calling it email, just in case the bots have an email address to fill to 'email' fields.

have a read through Essential PHP Security - it's a small book that should only last you a day but give you some more ideas.

[rich_b]

I would write something that logged the IP for each access attempt and if that IP attempted to send more than X messages in the last hour (for example) then don't send the message. This method isn't foolproof as I know that IPs can be spoofed but I don't know how hard it is to change IPs quickly. I haven't seen many attempts to spam my contact forms but when it has happened they have used no more than two different IP addresses so this method works well for me.

[Brett_Tabke]

Well, I think you already know the real answer:

This is a very public site, so I can't use a distorted image of letters that the user needs to type in.

There is there reason a you can't use a graphic? Even a simple graphic will purge 99% of the problematic attacks.

[louponne]

Thanks for your responses and help, folks!

le_gber, yes I'm already checking to be sure that all fields are correctly filled out. And yes, I've already tried changing the names of fields. And the form is perfectly *secure*

rich_b, the messages are scattered and not always sent by the same IP

Brett, yes, I agree that a CAPTCHA would be ideal but the problem is that the client won't want one of those things!

arg.

[dreamcatcher]

louponne, I find an effective spam solution is to have a simple sum in your form. Generate two random numbers and have the user add them together. Compare the input to the sum of the two numbers. There is a code snippet on the Zend website somewhere.

dc

[DewChugr]

You can use the info I posted here [webmasterworld.com...] to make sure your form has been submitted from your site and not from a remote abuser.

Steve