I have a form that was supplied by a third party to put onto a registration page. It works fine, but it looks very susceptible to a bot to send spam. I am trying to add a captcha but the form is posting before my validation fires. This is on an asp.net web form C# 4.0.
The form looks like this
<form method="post" name="upsideContactUsForm-1343676638998" action="https://3rdPartySite" id="form173" runat="server">
<input id="field0" value="" type="text" name="email" />
<!-- ..Other fields like first name, last name, etc -->
<input type="submit", value="submit"></input>
<script src="https://3rdPartySiteValidation.js" type="text/javascript"></script>
<script type="text/javascript">
var field0 = new LiveValidation("field0", { validMessage: "", onlyOnBlur: true });
field0.add(Validate.Presence, { failureMessage: "This field is required" });
field0.add(Validate.Email, { failureMessage: "Please enter a valid email address" });
//..Validation rules for the fields
</script>
</form>
I replaced the submit button with an asp:button and adding a captcha with a warning label. I am checking server side like this to see if I could prevent the page from firing but no luck.
protected void Submit_Click(object sender, EventArgs e) {
if (Page.IsValid)
{
CaptchaMsg.Text = "Your response is correct!";
}
else
{
CaptchaMsg.Text = "Your response is incorrect!";
}
}
Clicking the submit button with nothing in the captcha makes the form post and I am redirected to the page set in the form action. This is kind of what I expected would happen as I am posting a form, but I am not sure what direction to take to get around this. I could add a pass-through page that they are initially redirected to, but that seems sloppy. I also looked at answering my captcha with ajax, but that doesn't work if javascript is disabled.
Any suggestions?
