Spam problems with forms

toobusy

Hi,

Can anyone help with a recent development with getting spam through on webforms. We operated a web-based service where enquiries are automatically allocated to individuals according to a quota. The forms appear to be getting populated with spam HTML entries and are completely screwing things up for us as the form entry hits the database and messes up the quotas.

Is there an easy way to disable HTML entries or any other way to ensure that the forms are not being autopopulated by spammers? Options I have considered so far are CAPTCHA or putting in a T&Cs screen before displaying the form, but not being a PHP developer (the system is inherited), I suspect there is probably a much simpler way.

Any advice or reference to further info gratefully received. Thanks.

Weedpacket

Well, if there was a much simpler way, everyone would probably be using it instead of Turing tests like CAPTCHA.... 🙂

sitemaster

One of mine was getting spammed similarly; I had developed the form and response page with Dreamweaver and was passing the input of the form straight through without any form of checking - yes, I should have known better, especially with my background.

Someone was putting a long multipart message into the field designed to take only the enquirer's name. The quick fix I thought of was to crop the length of the input to say 30 characters, no-one's name will be longer than that.

If I had been handling this in Perl I would have stripped the input of everything except alphanumeric characters etc, I tried that with PHP's regular expressions but found them not quite as easy to use as Perl's.

Server-side verification is what's needed or CAPTCHA - that's what I'm working on now.

AbusiveWombat

Validate your input.

Email addresses should not contain "\n", "\r",...etc. I put together a simple pattern that I use with "preg_match" to ensure that email addresses follow the general guidelines for how an email address is put together.

Email subjects again should not contain "\n", "\r"...etc. Again, you can put together a pattern that will only allow valid characters in the email subject.

rikmoncur

http://www.anders.com/projects/sysadmin/formPostHijacking/