On my website I have a couple of forms where someone (without registration) can send message to specified, registered user. The form is simple, and I want to keep that way. What is the best way to protect a contact form againts spam and bots if I don't want to use any captcha?
Your message:...
Your e-mail:...
[Send]
You can protect your form with the form keys technique:
Without a captcha or something comparable, it is impossible to really protect a form from abuse.
However, using this technique a malicious spammer would have to
This technique also protects your form from multiple accidential submissions.
Here is a code example:
<?php
session_start();
if (isset($_POST['form_submit'])) {
// do stuff
if (isset($_POST['formkey']) && isset($_SESSION['formkeys'][$_POST['formkey']])) {
echo "valid, doing stuff now ... "; flush();
// delete formkey from session
unset($_SESSION['formkeys'][$_POST['formkey']]);
// release session early - after committing the session data is read-only
session_write_close();
// do whatever you like with the form data here
send_contact_mail($_POST);
}
else {
echo "request invalid or timed out.";
}
}
else {
// show form with formkey
$formkey = md5("foo".microtime().rand(1,999999));
// put current formkey into list of valid form keys for the user session
if (!is_array($_SESSION['formkeys']) {
$_SESSION['formkeys'] = array();
]
$_SESSION['formkeys'][$formkey] = now();
?>
<html>
<head><title>form key</title></head>
<body>
<form method="POST">
<input type="hidden" name="PHPSESSID" value="<?=session_id()?>">
<input type="text" name="formkey"
value="<?= $formkey ?>">
<input type="submit" name="form_submit" value="Contact us!">
</form>
</body>
</html>
<?php } ?>
In my opinion, many sites (excepting ticket sellers, major sites like google, and other sites that will be targeted) can prevent comment/form spam without a captcha by using a number of different techniques in combination. I recently created an open source PHP project that implements the following tests to determine if the submission is likely legitimate, or spam.
Here is the URL of the project. I like Kaii's test above, would make a great additional test for phpFormProtect. https://github.com/mccarthy/phpFormProtect
So the options:
Details on these and my opinion on them.
In my opinion, the best is solution 3, then solution 2, then solution 1, then solution 4 and 5.
You can implement a time limit from an IP. So if a spam bot tries to send the form again and again (in a specific time interval, say 1 hour), the request should be rejected.
You'll have to do this on the Server-Side by checking and storing the IPs of the users. Then when they again send the form, check if the user is already in the blocked IPs for the time being.
This is also what StackOverflow implemented 2years back.
Use: iScramble
It basically takes a string (your form html stored as a string in PHP) and generates a block of obfuscated Javascript.
It can help hide those form keys you are using to secure your forms, or completely hide your form from bots all together.
I've been using this since the 90's (the page at the link above is clearly at least that old) and I don't get form spam ever.
You can do something to prove the user is human. If you want to keep simple, maybe a field asking a math question, like "2 + 5?", for example. But that's not so secure as a captcha could be. But, if the possible spam doesn't botter you, it's ok to do that.
