Simple CSS/PHP AntiSpam solution for a contact form

[WhitePhoenix]

Hi again, here is what I did for the Create Account Form,


EDIT BOTH THESE FILES WITH THE CHANGES BELOW:

edit file - create_account.php (in includes/modules/YOURTEMPLATE/)
edit file - create_account.php (in includes/modules/)

after the line : (around 79)

$password = zen_db_prepare_input($_POST['password']);

add:

// BOF CSS_ANTI_SPAM
$leaveblank = zen_db_prepare_input($_POST["leaveblank"]);
// EOF CSS_ANTI_SPAM

look for: (around line 245)

if (strlen($password) < ENTRY_PASSWORD_MIN_LENGTH) {
$error = true;
$messageStack->add('create_account', ENTRY_PASSWORD_ERROR);
} elseif ($password != $confirmation) {
$error = true;
$messageStack->add('create_account', ENTRY_PASSWORD_ERROR_NOT_MATCHING);
}

directly underneath add:

// BOF CSS_ANTI_SPAM
if (!empty($leaveblank)) {
zen_redirect(zen_href_link(FILENAME_DEFAULT));
}
// EOF CSS_ANTI_SPAM



edit the file tpl_modules_create_account.php (includes/modules/templates/YOURTEMPLATE/templates/)

look for: (around line 159)

<fieldset>
<legend><?php echo TABLE_HEADING_LOGIN_DETAILS; ?></legend>
<label class="inputLabel" for="email-address"><?php echo ENTRY_EMAIL_ADDRESS; ?></label>
<?php echo zen_draw_input_field('email_address', '', zen_set_field_length(TABLE_CUSTOMERS, 'customers_email_address', '40') . ' id="email-address"') . (zen_not_null(ENTRY_EMAIL_ADDRESS_TEXT) ? '<span class="alert">' . ENTRY_EMAIL_ADDRESS_TEXT . '</span>': ''); ?>
<br class="clearBoth" />

directly underneath add:

<!-- NOSPAM -->
<input style="visibility:hidden; display:none;" name="leaveblank" type="text">
<br class="clearBoth" />
<!-- NO SPAM -->

look for: (around line 184)

<label class="inputLabel" for="password-confirm"><?php echo ENTRY_PASSWORD_CONFIRMATION; ?></label>
<?php echo zen_draw_password_field('confirmation', '', zen_set_field_length(TABLE_CUSTOMERS, 'customers_password', '20') . ' id="password-confirm"') . (zen_not_null(ENTRY_PASSWORD_CONFIRMATION_TEXT) ? '<span class="alert">' . ENTRY_PASSWORD_CONFIRMATION_TEXT . '</span>': ''); ?>
<br class="clearBoth" />
</fieldset>

directly underneath add:

<?php
// BOF insert for anti-spam-login
?>
<input style="visibility:hidden; display:none;" name="leaveblank" type="text">
<?php
// EOF insert for anti-spam-login
?>

Hope this also helps,
Using 1.5.0

[DivaVocals]

Curious, is this different than what's already been posted?? Also when posting code, you should enclose code inside the code tags to make it easier to read, and because the forum will sometimes parse what is meant to be code and obliterate it..

Hi, this works on my site, haven't had any spam since implementing the code,


edit file - header_php.php (in modules/pages/contact_us/)

after the line : (around 16)
$subject = zen_db_prepare_input($_POST['subject']);

add:

// NO SPAM
$leaveblank = zen_db_prepare_input($_POST["leaveblank"]);
// NO SPAM

just underneath, after:
$zc_validate_email = zen_validate_email($email_address);

change:
if ($zc_validate_email and !empty($enquiry) and !empty($name)) {

to:
if ($zc_validate_email and !empty($enquiry) and !empty($name) and empty($leaveblank)) {



edit the file tpl_contact_us_default.php (modules/templates/MY TEMPLATE/templates/)

look for: (around line 68)
<label class="inputLabel" for="email-address"><?php echo ENTRY_EMAIL; ?></label>
<?php echo zen_draw_input_field('email', ($email_address), ' size="40" id="email-address"') . '<span class="alert">' . ENTRY_REQUIRED_SYMBOL . '</span>'; ?>
<br class="clearBoth" />

directly underneath add:

<!-- NOSPAM -->
<input style="visibility:hidden; display:none;" name="leaveblank" type="text">
<br class="clearBoth" />
<!-- NO SPAM -->

Hope this helps,

[ray-the-otter]

Hi, I hope someone can help me with this.
I have followed the instructions from the OP in post one and all seems good. If the extra hidden field is filled in, I get a session timed out page.

However, if the contact us form is filled in by a human, when the 'Send' button is clicked, I do not get redirected to the index.php?main_page=contact_us&action=success page.

To the end user, it looks like nothing has happened as the page does not change. While the message is successfully sent and the email received from the customer, the customer doesn't know this, thus I receive 10 to 20 emails with the same message. The customer clearly just clicking repeatedly on Send.

Anyone else had this problem? Have I made an error?

I have tried this on a test website, Zen Cart 1.5 with No Mods

[ray-the-otter]

oh dear. i have just read post #69
I will try that! Thank you in advance Diva

[DivaVocals]

oh dear. i have just read post #69
I will try that! Thank you in advance Diva

You're welcome.. drove me batty too! That's why I posted my findings..

[DivaVocals]

So I decided to put together a summary post of all the things posted in this thread to help save others the troubles I ran into when trying to implement this solution.. I am using the posts by adem.i, dw08gm, and shartlesville as my references for the Contact Us form as it is a combination of their posts that got me on the right path with this solution. WhitePhoenix graciously provided the code for the Create an Account form..

I am only correcting code and path errors I found in some of these posts, and making sure that the code is inside forum code tags (makes the code much EASIER to read)... Otherwise all credit for the content of this post goes to the original contributors.

Also let me be clear here.. I am NOT taking anything away from dlg_ie who posted this ingenious solution in the first place. His original post did spur some great follow-up minor "improvements" IMHO.. The posts used as reference with these "improvements" aren't dramatically different from dlg_ie's original post. They do however include two things that I felt were important "improvements" as follows:

1. Faking a success message for the bots
2. Comments so that these changes are easy to spot in the event of upgrades/other enhancements

Maybe someone should put this all together as a proper add-on.. and yes I am throwing this out to the universe/community at large because I personally have no plans to throw my hat into that ring.. Doesn't mean it's not a good idea for SOMEONE ELSE to do it though..


Contact Us Page
in /includes/templates/YOUR_TEMPLATE/templates/tpl_contact_us_default.php find:

<label class="inputLabel" for="email-address"><?php echo ENTRY_EMAIL; ?></label>
<?php echo zen_draw_input_field('email', ($email_address), '  size="40" id="email-address"') . '<span class="alert">' .  ENTRY_REQUIRED_SYMBOL . '</span>'; ?>
<br class="clearBoth" />

directly under it put this:

<!-- NOSPAM -->
<input style="visibility:hidden; display:none;" name="leaveblank" type="text">
<br class="clearBoth" />
<!-- NO SPAM -->

in includes/modules/pages/contact_us/header.php make the following changes:
Highlight this (around line 14):

$error = false;
if (isset($_GET['action']) && ($_GET['action'] == 'send')) {
  $name = zen_db_prepare_input($_POST['contactname']);
  $email_address = zen_db_prepare_input($_POST['email']);
  $subject = zen_db_prepare_input($_POST['subject']);
  $enquiry = zen_db_prepare_input(strip_tags($_POST['enquiry']));

  $zc_validate_email = zen_validate_email($email_address);
  if ($zc_validate_email and !empty($enquiry) and !empty($name)) {

Replace that entire block with this:

$error = false;
if (isset($_GET['action']) && ($_GET['action'] == 'send')) {
  $name = zen_db_prepare_input($_POST['contactname']);
  $email_address = zen_db_prepare_input($_POST['email']);
  $subject = zen_db_prepare_input($_POST['subject']);
  // NO SPAM
  $leaveblank = zen_db_prepare_input($_POST["leaveblank"]);
  // NO SPAM
  $enquiry = zen_db_prepare_input(strip_tags($_POST['enquiry']));
  
  //edited for NO SPAM
  $zc_validate_email = zen_validate_email($email_address);

  if ($zc_validate_email and !empty($enquiry) and !empty($name) and empty($leaveblank)) {

Then find (around line 93):

    if (empty($enquiry)) {
      $messageStack->add('contact', ENTRY_EMAIL_CONTENT_CHECK_ERROR);
    }

Directly under it add:

    //NO SPAM
    if (!empty($leaveblank)) {
    zen_redirect(zen_href_link(FILENAME_TIME_OUT, 'action=success'));
    }
    //NO SPAM

Create New Account
in includes/modules/YOUR_TEMPLATE/create_account.php make the following changes:
(This is the ONLY file you will make this edit to. Please note in WhitePhoenix's original post it was suggested to also edit includes/modules/create_account.php.Please note that this edit should ONLY be done as an override. Therefore DO NOT add these edits toincludes/modules/create_account.php)

around line 79 find:

$password = zen_db_prepare_input($_POST['password']);

Directly under it add:

// BOF CSS_ANTI_SPAM
$leaveblank = zen_db_prepare_input($_POST["leaveblank"]);
// EOF CSS_ANTI_SPAM

around line 245 find:

if (strlen($password) < ENTRY_PASSWORD_MIN_LENGTH) {
    $error = true;
    $messageStack->add('create_account', ENTRY_PASSWORD_ERROR);
  } elseif ($password != $confirmation) {
    $error = true;
    $messageStack->add('create_account', ENTRY_PASSWORD_ERROR_NOT_MATCHING);
  }

Directly under it add:

  // BOF CSS_ANTI_SPAM
  if (!empty($leaveblank)) {
    zen_redirect(zen_href_link(FILENAME_DEFAULT));
    }
  // EOF CSS_ANTI_SPAM

in includes/templates/YOUR_TEMPLATE/templates/tpl_modules_create_account.php
around line 159 find:

<fieldset>
<legend><?php echo TABLE_HEADING_LOGIN_DETAILS; ?></legend>
<label class="inputLabel" for="email-address"><?php echo ENTRY_EMAIL_ADDRESS; ?></label>
<?php echo zen_draw_input_field('email_address', '',  zen_set_field_length(TABLE_CUSTOMERS, 'customers_email_address', '40') .  ' id="email-address"') . (zen_not_null(ENTRY_EMAIL_ADDRESS_TEXT) ?  '<span class="alert">' . ENTRY_EMAIL_ADDRESS_TEXT .  '</span>': ''); ?>
<br class="clearBoth" />

Directly under it add:

<!-- NOSPAM -->
<input style="visibility:hidden; display:none;" name="leaveblank" type="text">
<br class="clearBoth" />
<!-- NO SPAM -->

around line 184 find:

<label class="inputLabel" for="password-confirm"><?php echo ENTRY_PASSWORD_CONFIRMATION; ?></label>
<?php echo zen_draw_password_field('confirmation', '',  zen_set_field_length(TABLE_CUSTOMERS, 'customers_password', '20') . '  id="password-confirm"') .  (zen_not_null(ENTRY_PASSWORD_CONFIRMATION_TEXT) ? '<span  class="alert">' . ENTRY_PASSWORD_CONFIRMATION_TEXT . '</span>':  ''); ?>
<br class="clearBoth" />
</fieldset>

Directly under it add:

<?php 
// BOF insert for anti-spam-login
?>
<input style="visibility:hidden; display:none;" name="leaveblank" type="text">
<?php
// EOF insert for anti-spam-login
?>

Test your forms normally to make sure you DO get the proper e-mails back. Then using firefox, disable the inline CSS styles filling out all the lines including the one that should be blank. When you hit send, you should be redirected to the session timed out page. If you get blank pages or the email goes through when it shouldn't, verify all the changes for missing punctuation and check the CACHE file for errors.

If you are using the "Report a Cheaper Price" mod, shartlesville's original post will help you with modifying this form:
http://www.zen-cart.com/showthread.p...34#post1078934

For the Report A Cheaper Price mod in includes/templates/template_default/tpl_report_a_price_default.php find (about line 74):

<label class="inputLabel" for="email-address"><?php echo ENTRY_EMAIL; ?></label>
<?php echo zen_draw_input_field('email', ($error ? $_POST['email'] :  $email), ' size="40" id="email-address"') . '<span class="alert">'  . ENTRY_REQUIRED_SYMBOL . '</span>'; ?>
<br class="clearBoth" />

directly under it add:

<!-- NOSPAM -->
<input style="visibility:hidden; display:none;" name="leaveblank" type="text">
<br class="clearBoth" />
<!-- NO SPAM -->

Then in includes/modules/pages/report_a_price/header.php find (about line 35):

$error = false;
if (isset($_GET['action']) && ($_GET['action'] == 'send')) {
  $name = zen_db_prepare_input($_POST['contactname']);
  $email_address = zen_db_prepare_input($_POST['email']);
  $other_store = zen_db_prepare_input(strip_tags($_POST['other_store']));
  $other_store_location = zen_db_prepare_input(strip_tags($_POST['other_store_location']));
  $other_price = zen_db_prepare_input(strip_tags($_POST['other_price']));

  $zc_validate_email = zen_validate_email($email_address);

  if ($zc_validate_email and !empty($other_store) and  !empty($other_store_location) and !empty($other_price) and  !empty($name)) {

Replace with

$error = false;
if (isset($_GET['action']) && ($_GET['action'] == 'send')) {
  $name = zen_db_prepare_input($_POST['contactname']);
  $email_address = zen_db_prepare_input($_POST['email']);
  // NO SPAM
  $leaveblank = zen_db_prepare_input($_POST['leaveblank']);
  // NO SPAM
  $other_store = zen_db_prepare_input(strip_tags($_POST['other_store']));
  $other_store_location = zen_db_prepare_input(strip_tags($_POST['other_store_location']));
  $other_price = zen_db_prepare_input(strip_tags($_POST['other_price']));

  $zc_validate_email = zen_validate_email($email_address);

  if ($zc_validate_email and !empty($other_store) and  !empty($other_store_location) and !empty($other_price) and !empty($name)  and empty($leaveblank)) {

Test the form normally to make sure you DO get mail from customers. Then using firefox, disable the inline CSS styles filling out all the lines including the one that should be blank. When you hit send, you should be redirected to the session timed out page. If you get blank pages or the email goes through when it shouldn't, verify all the changes for missing punctuation and check the CACHE file for errors.

If you get a blank page after this, check for syntax errors - I had an extra } on line 128 next to

} // end  action==send

When I deleted it, it worked.

[ray-the-otter]

Maybe someone should put this all together as a proper add-on.. and yes I am throwing this out to the universe/community at large because I personally have no plans to throw my hat into that ring.. Doesn't mean it's not a good idea for SOMEONE ELSE to do it though..

I will take on this role, unless someone far more skilled than myself wishes too?
Sadly, I won't be able to do this until Wednesday 23rd Aug as I am stacked with deadlines.

It is the least I can do to help those that have helped me.

[ray-the-otter]

Hi Diva, May I trouble you for some assistance in packaging this up into a downloadable addon?

It is regards the Create Account Section

1) When I disable CSS and complete all fields, rather than getting a "When you hit send, you should be redirected to the session timed out page." I am returned to the index page. I get no error logs in my CACHE folder and the account is NOT created. So is this the correct action?

2) in includes/templates/YOUR_TEMPLATE/templates/tpl_modules_create_account.php

<!-- NOSPAM -->
<input style="visibility:hidden; display:none;" name="leaveblank" type="text">
<br class="clearBoth" />
<!-- NO SPAM -->

What does it do, other than create a hidden text field? With this added I have TWO hidden text fields. I have tested the form with both leaving this blank or filled in, and it seems to have no effect?... It is the text input field that is created with

<?php 
// BOF insert for anti-spam-login
?>
<input style="visibility:hidden; display:none;" name="leaveblank" type="text">
<?php
// EOF insert for anti-spam-login
?>

That sends the user to the index page when filled in.

Is it safe to not include

<!-- NOSPAM -->
<input style="visibility:hidden; display:none;" name="leaveblank" type="text">
<br class="clearBoth" />
<!-- NO SPAM -->

--------------------------------------

I ask as your technical knowledge is far greater than mine and your input highly appreciated.

[DrByte]

Maybe someone should put this all together as a proper add-on.

It's built-in to the core files (not addons) of the next release of Zen Cart.

[ray-the-otter]

Assuming the next release is a 1.5.x should I not proceed?
Or are you referring to a 1.6/2.0? In which I could proceed?

Only asking as to not waste time on something already done by the Dev team, not fishing for a date or anything.