[RESOLVED] Strange input on form -- all email addresses

[riojimmy]

HI, I have a form which is validated by javascript, and has been functioning just fine for a year. Suddenly over the weekend some spammer running some sort of program managed to submit the form with only program generated emails in the fields, including the radio buttons and list menus.

This email address was repeated in all the fields and of course submitted as the From address as well.

we received a total of 115 of these. (which I guess isn't a great many)
Oh and the email address was a spammed version of our own.

Is there a way to avoid such attacks without having to block entire ip addresses?

And/or can you direct me to further information on such tactics?

thanks

[toplay]

For one thing, use Image verification for form input so you know a human entered the data at least - go to this page and click on "Security Image Generator" for a free one:

http://theomega.org/projects.php

🙂

[wulfhere]

I had the same problem this weekend. Looking through my server's mail logs, it doesn't look like it was sending email out to anybody other than the intended recipient of the web form (thank heavens), but it sure is annoying.

Looking at the Apache logs, it looks like they're POSTing directly to the PHP script itself (the one that actually handles the form input). Is there any way to prevent that? I saw toplay's recommendation for using a security image generator, but I hate to confuse potential customers any more than necessary!

-Wulfhere

[riojimmy]

Thank you toplay that's a very good suggestion for us since we have "regular" customers I can rig some sort of visual with a onclick radio button which will populate a field that I can verify after the fact within the processing script.

Hi wulfhere, you said that it's posting to the script itself?
I have a field requrement (and now I have two) to start my script,

They have to submit the data in that field for the script to fire otherwise it doesn't.

How would they have gotten by that without having first reviewed the form, and then figuring out which field is the required field the form is looking for?

Which as it happens is the email field, and that is what was in all the fields as previously stated.

What do you think?

[Rodney_H_]

You can also create an invisible field on your "form.htm" page and assign it a value. Then, on your "form_process.php" if the value of the hidden field doesn't equal the value that YOU assigned it, then you can bounce them back. Just a thought, but it works for me as an additional security step.

[riojimmy]

A hidden field too, well that should cover it all, thanks for that suggestion Rodney

Well until they crack all that I'm going to mark this resolved.

Thanks everyone.

[wulfhere]

Rodney,

Can you provide a code snippet for how you did this? I'd be interested in seeing how it works...

[riojimmy]

here's mine:

I haven't done the "visual one" yet but for now the script file checks for:
email,
the new hidden code which is $nml_code
and I added a check for a number in the zip code

if ($email && $nml_code) {
if ($Zip > 0) {
echo 'good stuff';
}
}
else { nothing }