Forum Moderators: coopster

Message Too Old, No Replies

PHP Form Question

Need help against spam bots

         

naitsirhc26

8:20 pm on Jul 21, 2007 (gmt 0)

10+ Year Member



Hello To All,

On my website, I use this form for all of my form scripts. The only thing that it is lacking is an image verification script built into it. Is there any bit of code that I can add into here to make it so that the person that submits the form has to do an image verification? And it doesn't have to be complicated either. It can just be 1 image, no rotating images. Another option I am open to is making it so they have to do a simple math problem. Any thoughts?

Here is my code so far:

<?php
if ($_SERVER['REQUEST_METHOD']=="POST"){
// In testing, if you get an Bad referer error
// comment out or remove the next three lines
if (strpos($_SERVER['HTTP_REFERER'], $_SERVER['HTTP_HOST'])>7 ¦¦
!strpos($_SERVER['HTTP_REFERER'], $_SERVER['HTTP_HOST']))
die("Bad referer");
$msg="Values submitted by the user:\n";
foreach($_POST as $key => $val){
if (is_array($val)){
$msg.="Item: $key\n";
foreach($val as $v){
$v = stripslashes($v);
$msg.=" $v\n";
}
} else {
$val = stripslashes($val);
$msg.="$key: $val\n";
}
}
$recipient="example@example.com";
$subject="Add Site Form";
error_reporting(0);
if (mail($recipient, $subject, $msg, "", "-f example@example.com")){
echo "<center><h1>Thank you</h1><p>Message successfully sent! You will be redirected to the home page.</p></center><br>\n";
echo nl2br($input);
} else
echo "An error occurred and the message could not be sent.";
} else
echo "Bad request method";

?>

Thank you very much for all of your help!

Cheerful Trails,

Christian

[edited by: encyclo at 8:27 pm (utc) on July 21, 2007]
[edit reason] obscured email address [/edit]

WesleyC

10:07 pm on Jul 21, 2007 (gmt 0)

10+ Year Member



Another method you could use is to insert a hidden form field in the source, then use javascript or, better, CSS to hide it (this prevents bots checking for <input type="hidden"> fields), then check if this value is filled in your PHP code. If it's filled in... you know you've either got a 'bot or someone who likes to tinker a bit too much on your hands.

eelixduppy

7:09 am on Jul 23, 2007 (gmt 0)



We have a thread in our library that you may want to take a look at: combatting webform hijack [webmasterworld.com].

naitsirhc26

9:08 pm on Jul 23, 2007 (gmt 0)

10+ Year Member



Thanks for the input!