Count number of same comments?

jasondavis

I have a social network similar to myspace.
Sometimes people will comment spam on profile, they will for instance post a ringtone add on 400 user profiles as a comment, Im looking for ways to avoid this, any ideas?

Myspace does it where is you post x amount of comments in x amount of time then you have to enter a captcha code, but Im not sure how to do this, it sounds like it would be rather servger intensive as well to check this

maxpup979

A captcha would work just fine--but the way I have done this in the past year for a public comment form is to add a text field that is hidden through css (display:none) and leave it blank. Then when you process the form, test to make sure the field is still blank. If it isn't, then you know this is a bot attempt. It isn't a perfect solution, but it has reduced the spam by around 95%.

jasondavis

maxpup979 wrote:
A captcha would work just fine--but the way I have done this in the past year for a public comment form is to add a text field that is hidden through css (display:none) and leave it blank. Then when you process the form, test to make sure the field is still blank. If it isn't, then you know this is a bot attempt. It isn't a perfect solution, but it has reduced the spam by around 95%.

I guess the way myspace does the captcha though is like if you post 30 comments within an hour you get a captcha but if you post 30 comments over a days time you don't any ideas how to do something like this?

Also Im interested in your technique of the hidden field, care to share a sample code?

thanks for the help/ideas

maxpup979

It really is quite trivial--in the form, I have the following:

<span style="display:none;">Leave This Field Blank</span>
<input type="text" name="username123" value="" style="display:none;">

and the processing page has this:

if((isset($_POST['username123']))&&($_POST['username123']=="")){
     #This is most likely a valid entry: take appropriate actions
     }
}else{
     #This is most likely a bot: throw error message and
     #stop application processing
}

As for the comment form generating a captcha after 20 minutes...
all you have to do is query the comment db to see how many comments this user has put in over a timespan--if it is greater than 30, include the captcha routine.

jasondavis

SO am I following this right, when a person trys to make a bot and they are looking at your source, they won't see these fields in the code?

maxpup979 wrote:
It really is quite trivial--in the form, I have the following:
<span style="display:none;">Leave This Field Blank</span>
<input type="text" name="username123" value="" style="display:none;">
and the processing page has this:
if((isset($_POST['username123']))&&($_POST['username123']=="")){
     #This is most likely a valid entry: take appropriate actions
     }
}else{
     #This is most likely a bot: throw error message and
     #stop application processing
}
As for the comment form generating a captcha after 20 minutes...
all you have to do is query the comment db to see how many comments this user has put in over a timespan--if it is greater than 30, include the captcha routine.

jasondavis

I must of misunderstood because when I view sourse I can see

<span style="display:none;">Blank</span>
<input type="text" name="postyes" value="" style="display:none;">

so if someone wanted to make a bot they could just submit that code right?

maxpup979

They could do that. Absolutely. But they almost never do. I run this code on a VERY public comment form, and I actually have it set to process everything that comes in--spam or not--Just so I can keep track of whats going on--I went from getting 400-500 spams a day to 4-5. So while it isn't perfect, it is quick and simple, and generally does the trick.

jasondavis

ok thanks, I suppose I could change the name of the hidden field often too

maxpup979

I haven't had to touch it, and it has been up for over a year. If you stop and think about it for a bit, it does make sense. Most spammers are interested in hitting as many sites as possible, but they don't really care about each individual one. They generally just have a script that reads form fields, populates them, and submits them. simple as that.

jasondavis

yeah generaly you are right but in my site, its a lil different, because on my site there are literally hundreds of thousands of pages to spam for different user profiles and picture comments, people actually make bots just to target my site, maybe I could use something like you use but change the filed name every 5 minutes or something

mpb001

http://research.microsoft.com/asirra/

Friendlier and more useful than captcha. Though it's going a bit freaky today. There is ahotcaptcha version http://www.hotcaptcha.com/ though picking the hot guys or hot girls is a bit more subjective than picking the pussy cats or puppy dogs.

NogDog

You might want to take a look at reCaptcha and kill two birds with one stone, as the saying goes.