Simple CSS/PHP AntiSpam solution for a contact form

[DivaVocals]

Hi Diva, May I trouble you for some assistance in packaging this up into a downloadable addon?

It is regards the Create Account Section

1) When I disable CSS and complete all fields, rather than getting a "When you hit send, you should be redirected to the session timed out page." I am returned to the index page. I get no error logs in my CACHE folder and the account is NOT created. So is this the correct action?

2) in includes/templates/YOUR_TEMPLATE/templates/tpl_modules_create_account.php

<!-- NOSPAM -->
<input style="visibility:hidden; display:none;" name="leaveblank" type="text">
<br class="clearBoth" />
<!-- NO SPAM -->

What does it do, other than create a hidden text field? With this added I have TWO hidden text fields. I have tested the form with both leaving this blank or filled in, and it seems to have no effect?... It is the text input field that is created with

<?php 
// BOF insert for anti-spam-login
?>
<input style="visibility:hidden; display:none;" name="leaveblank" type="text">
<?php
// EOF insert for anti-spam-login
?>

That sends the user to the index page when filled in.

Is it safe to not include

<!-- NOSPAM -->
<input style="visibility:hidden; display:none;" name="leaveblank" type="text">
<br class="clearBoth" />
<!-- NO SPAM -->

--------------------------------------

I ask as your technical knowledge is far greater than mine and your input highly appreciated.

I have no greater technical knowledge persay. I just read a lot and test a lot.. to answer your question, I have not used WhitePhoenix's code and only reviewed it to ensure that it did not include errors previously posted and to correct file paths and other issues I found with code posted in this thread. That said in really looking it over that code, I see it does indeed add TWO hidden fields.. I suspect that WhitePhoenix was not even aware of this and simply just following instructions found on the web or this thread. In any case you certainly don't NEED two hidden fields for this solution to work. One will do.. Eliminate whichever one you like..

As for the redirect: Sorry about that.. again I was reviewing the code WhitePhoenix posted for obvious errors when I re-posted it, and I missed that.. If you look at the code that the Create Account form uses for the re-direct, "FILENAME_DEFAULT" is the constant for the home page

  // BOF CSS_ANTI_SPAM
  if (!empty($leaveblank)) {
    zen_redirect(zen_href_link(FILENAME_DEFAULT));
    }
  // EOF CSS_ANTI_SPAM

If you want it to re-direct the same way the Contact Us for does (to a "timed out" page), then use this code instead.

    //NO SPAM
    if (!empty($leaveblank)) {
    zen_redirect(zen_href_link(FILENAME_TIME_OUT, 'action=success'));
    }
    //NO SPAM

It's built-in to the core files (not addons) of the next release of Zen Cart.

Awesome!! It's such a simple and cool solution.. I have the same question ray posed, is this gonna be in a upcoming 1.5.x release??

[DrByte]

Yes .

[DivaVocals]

Yes .

Coolbeans.. Ya'll rock!!!

[graeme john]

Just a small caveat. Although this works really well, the problem for me is I, and many others in this security conscious world use a password manager that fills forms etc. so using this system I get redirected, not registered. Small problem, but for me renders this system unusable.

[shartlesville]

If you do it yourself instead of using the auto-fill will it work?

If yes, you could add a note telling your customers to do it themselves rather than using a automated service when registering.

[DivaVocals]

Just a small caveat. Although this works really well, the problem for me is I, and many others in this security conscious world use a password manager that fills forms etc. so using this system I get redirected, not registered. Small problem, but for me renders this system unusable.

Why would a password manager interfere with filling out the Contact Us, or Create Account forms??

If you do it yourself instead of using the auto-fill will it work?

If yes, you could add a note telling your customers to do it themselves rather than using a automated service when registering.

You can't autofill the Contact Us form, the message body needs a HUMAN to fill out..

[gjh42]

A password manager would presumably fill in fields with certain labels with the corresponding information... but would this necessarily fill in fields that you don't tell it to? And yes, why would a password manager come into play when filling out a contact us form? I imagine a password manager that didn't have manual overrides could give bad results in a large number of cases where inputs are not precisely identified.

[Limitless]

Google Chrome's autofill (while not a password manager) does exactly that.

Had an issue while trying to register on Mailbeez Blog (Wordpress) site due to a 'security' plugin that did the exact same thing.

[DivaVocals]

A password manager would presumably fill in fields with certain labels with the corresponding information... but would this necessarily fill in fields that you don't tell it to? And yes, why would a password manager come into play when filling out a contact us form? I imagine a password manager that didn't have manual overrides could give bad results in a large number of cases where inputs are not precisely identified.

Exactly..

If a "password manager" fills in all the fields on a CONTACT US form, I have to wonder about that "password manager" since a contact form is NOT a login page.. Now if that "password manager" same and fills them in incorrectly then that's a POORLY functioning "password manager" since there are no passwords on a contact us form.. Certainly the message body fields should NOT be something that is autofilled..

Google Chrome's autofill (while not a password manager) does exactly that.

Had an issue while trying to register on Mailbeez Blog (Wordpress) site due to a 'security' plugin that did the exact same thing.

Auto-fill is a function available in most modern browsers. While auto-fill can FILL out a form and save login information, I've yet to run into a situation where the browser auto-fills and AUTO SUBMITS a form. Anyone using any kind of program that auto-submits a form should DUMP the program.. Auto-submit IS a security issue..

Bottomline is that unless you are using some kind of auto-filler that is auto-submitting a form this is a NON issue IMHO.. Otherwise I'm sure that a LOT more folks would have shared that this is an issue.. For anyone REALLY worried about auto-filler programs while using this hidden field method as an anti-spam solution, auto-fill is EASILY defeated by adding autocomplete="off" to the form markup for the various form fields. (Which is EXACTLY how the v1.5 login form works)

[Limitless]

I do use it to fill out the common form stuff, name, email, etc.
Not saying it auto submitted the form, but How do I know if filled out a hidden field?

autocomplete=off is often used on CC # fields and is a good solution.