Forums / All Other Contributions/Addons / Simple CSS/PHP AntiSpam solution for a contact form

Simple CSS/PHP AntiSpam solution for a contact form

Views: 49,009

Results 81 to 100 of 131
16 Aug 2012, 1:29 PM
#81
divavocals avatar

divavocals

Totally Zenned

Join Date:
Jan 2007
Location:
Los Angeles, California, United States
Posts:
10,011
Plugin Contributions:
3

Simple CSS/PHP AntiSpam solution for a contact form

ray-the-otter:

Hi Diva, May I trouble you for some assistance in packaging this up into a downloadable addon?

It is regards the Create Account Section

  1. When I disable CSS and complete all fields, rather than getting a "When you hit send, you should be redirected to the session timed out page." I am returned to the index page. I get no error logs in my CACHE folder and the account is NOT created. So is this the correct action?

  2. in includes/templates/YOUR_TEMPLATE/templates/tpl_modules_create_account.php

<!-- NOSPAM --> <input style="visibility:hidden; display:none;" name="leaveblank" type="text"> <br class="clearBoth" /> <!-- NO SPAM --> ``` > > What does it do, other than create a hidden text field? With this added I have TWO hidden text fields. I have tested the form with both leaving this blank or filled in, and it seems to have no effect?... It is the text input field that is created with ``` <?php // BOF insert for anti-spam-login ?> <input style="visibility:hidden; display:none;" name="leaveblank" type="text"> <?php // EOF insert for anti-spam-login ?> ``` That sends the user to the index page when filled in. > > Is it safe to not include ``` <!-- NOSPAM --> <input style="visibility:hidden; display:none;" name="leaveblank" type="text"> <br class="clearBoth" /> <!-- NO SPAM --> ``` > -------------------------------------- > > I ask as your technical knowledge is far greater than mine and your input highly appreciated.

I have no greater technical knowledge persay. I just read a lot and test a lot..:yes: to answer your question, I have not used WhitePhoenix's code and only reviewed it to ensure that it did not include errors previously posted and to correct file paths and other issues I found with code posted in this thread. That said in really looking it over that code, I see it does indeed add TWO hidden fields.. I suspect that WhitePhoenix was not even aware of this and simply just following instructions found on the web or this thread. In any case you certainly don't NEED two hidden fields for this solution to work. One will do.. Eliminate whichever one you like..

As for the redirect: Sorry about that.. again I was reviewing the code WhitePhoenix posted for obvious errors when I re-posted it, and I missed that.. If you look at the code that the Create Account form uses for the re-direct, "FILENAME_DEFAULT" is the constant for the home page

  // BOF CSS_ANTI_SPAM
  if (!empty($leaveblank)) {
    zen_redirect(zen_href_link(FILENAME_DEFAULT));
    }
  // EOF CSS_ANTI_SPAM

If you want it to re-direct the same way the Contact Us for does (to a "timed out" page), then use this code instead.

    //NO SPAM
    if (!empty($leaveblank)) {
    zen_redirect(zen_href_link(FILENAME_TIME_OUT, 'action=success'));
    }
    //NO SPAM

DrByte:

It's built-in to the core files (not addons) of the next release of Zen Cart.Awesome!! It's such a simple and cool solution.. I have the same question ray posed, is this gonna be in a upcoming 1.5.x release??

My Site - Zen Cart & WordPress integration specialist
I don't answer support questions via PM. Post add-on support questions in the support thread. The question & the answer will benefit others with similar issues.

16 Aug 2012, 3:41 PM
#82
drbyte avatar

drbyte

Sensei

Join Date:
Jan 2004
Posts:
63,513
Plugin Contributions:
176

Re: Simple CSS/PHP AntiSpam solution for a contact form

Yes .

.
Zen Cart - putting the dream of business ownership within reach of anyone!
Donate to: DrByte directly or to the Zen Cart team as a whole

Remember: Any code suggestions you see here are merely suggestions. You assume full responsibility for your use of any such suggestions, including any impact ANY alterations you make to your site may have on your PCI compliance.
Furthermore, any advice you see here about PCI matters is merely an opinion, and should not be relied upon as "official". Official PCI information should be obtained from the PCI Security Council directly or from one of their authorized Assessors.

16 Aug 2012, 3:45 PM
#83
divavocals avatar

divavocals

Totally Zenned

Join Date:
Jan 2007
Location:
Los Angeles, California, United States
Posts:
10,011
Plugin Contributions:
3

Re: Simple CSS/PHP AntiSpam solution for a contact form

DrByte:

Yes .
Coolbeans.. Ya'll rock!!!:clap:

My Site - Zen Cart & WordPress integration specialist
I don't answer support questions via PM. Post add-on support questions in the support thread. The question & the answer will benefit others with similar issues.

10 Sep 2012, 12:24 AM
#84
graeme_john avatar

graeme_john

New Zenner

Join Date:
Jul 2012
Posts:
4
Plugin Contributions:
0

Re: Simple CSS/PHP AntiSpam solution for a contact form

Just a small caveat. Although this works really well, the problem for me is I, and many others in this security conscious world use a password manager that fills forms etc. so using this system I get redirected, not registered. Small problem, but for me renders this system unusable.

10 Sep 2012, 1:08 AM
#85
shartlesville avatar

shartlesville

New Zenner

Join Date:
Jul 2009
Location:
Roswell, NM, USA
Posts:
103
Plugin Contributions:
0

Re: Simple CSS/PHP AntiSpam solution for a contact form

If you do it yourself instead of using the auto-fill will it work?

If yes, you could add a note telling your customers to do it themselves rather than using a automated service when registering.

I donate to the Zen Team do you?
My current project: BestSewingDeals.com;

10 Sep 2012, 2:55 AM
#86
divavocals avatar

divavocals

Totally Zenned

Join Date:
Jan 2007
Location:
Los Angeles, California, United States
Posts:
10,011
Plugin Contributions:
3

Re: Simple CSS/PHP AntiSpam solution for a contact form

graeme john:

Just a small caveat. Although this works really well, the problem for me is I, and many others in this security conscious world use a password manager that fills forms etc. so using this system I get redirected, not registered. Small problem, but for me renders this system unusable.Why would a password manager interfere with filling out the Contact Us, or Create Account forms??

shartlesville:

If you do it yourself instead of using the auto-fill will it work?

If yes, you could add a note telling your customers to do it themselves rather than using a automated service when registering.
You can't autofill the Contact Us form, the message body needs a HUMAN to fill out..

My Site - Zen Cart & WordPress integration specialist
I don't answer support questions via PM. Post add-on support questions in the support thread. The question & the answer will benefit others with similar issues.

10 Sep 2012, 3:05 AM
#87
gjh42 avatar

gjh42

Black Belt

Join Date:
Jul 2005
Location:
Upstate NY
Posts:
21,876
Plugin Contributions:
8

Re: Simple CSS/PHP AntiSpam solution for a contact form

A password manager would presumably fill in fields with certain labels with the corresponding information... but would this necessarily fill in fields that you don't tell it to? And yes, why would a password manager come into play when filling out a contact us form? I imagine a password manager that didn't have manual overrides could give bad results in a large number of cases where inputs are not precisely identified.

10 Sep 2012, 3:42 AM
#88
limitless avatar

limitless

Inactive

Join Date:
Jan 2012
Posts:
496
Plugin Contributions:
0

Re: Simple CSS/PHP AntiSpam solution for a contact form

Google Chrome's autofill (while not a password manager) does exactly that.

Had an issue while trying to register on Mailbeez Blog (Wordpress) site due to a 'security' plugin that did the exact same thing.

10 Sep 2012, 5:07 AM
#89
divavocals avatar

divavocals

Totally Zenned

Join Date:
Jan 2007
Location:
Los Angeles, California, United States
Posts:
10,011
Plugin Contributions:
3

Re: Simple CSS/PHP AntiSpam solution for a contact form

gjh42:

A password manager would presumably fill in fields with certain labels with the corresponding information... but would this necessarily fill in fields that you don't tell it to? And yes, why would a password manager come into play when filling out a contact us form? I imagine a password manager that didn't have manual overrides could give bad results in a large number of cases where inputs are not precisely identified.Exactly..

If a "password manager" fills in all the fields on a CONTACT US form, I have to wonder about that "password manager" since a contact form is NOT a login page.. Now if that "password manager" same and fills them in incorrectly then that's a POORLY functioning "password manager" since there are no passwords on a contact us form.. Certainly the message body fields should NOT be something that is autofilled..

Limitless:

Google Chrome's autofill (while not a password manager) does exactly that.

Had an issue while trying to register on Mailbeez Blog (Wordpress) site due to a 'security' plugin that did the exact same thing.Auto-fill is a function available in most modern browsers. While auto-fill can FILL out a form and save login information, I've yet to run into a situation where the browser auto-fills and AUTO SUBMITS a form. Anyone using any kind of program that auto-submits a form should DUMP the program.. Auto-submit IS a security issue..

Bottomline is that unless you are using some kind of auto-filler that is auto-submitting a form this is a NON issue IMHO.. Otherwise I'm sure that a LOT more folks would have shared that this is an issue.. For anyone REALLY worried about auto-filler programs while using this hidden field method as an anti-spam solution, auto-fill is EASILY defeated by adding autocomplete="off" to the form markup for the various form fields. (Which is EXACTLY how the v1.5 login form works)

My Site - Zen Cart & WordPress integration specialist
I don't answer support questions via PM. Post add-on support questions in the support thread. The question & the answer will benefit others with similar issues.

10 Sep 2012, 5:13 AM
#90
limitless avatar

limitless

Inactive

Join Date:
Jan 2012
Posts:
496
Plugin Contributions:
0

Re: Simple CSS/PHP AntiSpam solution for a contact form

I do use it to fill out the common form stuff, name, email, etc.
Not saying it auto submitted the form, but How do I know if filled out a hidden field?

autocomplete=off is often used on CC # fields and is a good solution.

10 Sep 2012, 6:08 AM
#91
divavocals avatar

divavocals

Totally Zenned

Join Date:
Jan 2007
Location:
Los Angeles, California, United States
Posts:
10,011
Plugin Contributions:
3

Re: Simple CSS/PHP AntiSpam solution for a contact form

Limitless:

I do use it to fill out the common form stuff, name, email, etc.
Not saying it auto submitted the form, but How do I know if filled out a hidden field?

autocomplete=off is often used on CC # fields and is a good solution.It depends on how the form handler is setup to deal with the hidden fields.. But if you have an auto-filler that is filling out hidden fields I'd be concerned about using this auto form filler.. It means it's behaving like the bots this solution is meant to defeat..

My Site - Zen Cart & WordPress integration specialist
I don't answer support questions via PM. Post add-on support questions in the support thread. The question & the answer will benefit others with similar issues.

10 Sep 2012, 6:45 AM
#92
drbyte avatar

drbyte

Sensei

Join Date:
Jan 2004
Posts:
63,513
Plugin Contributions:
176

Re: Simple CSS/PHP AntiSpam solution for a contact form

DivaVocals:

auto-fill is EASILY defeated by adding autocomplete="off" to the form markup for the various form fields.
Limitless:

autocomplete=off is often used on CC # fields and is a good solution.
... and is also what's used in the upcoming v1.5.1

.
Zen Cart - putting the dream of business ownership within reach of anyone!
Donate to: DrByte directly or to the Zen Cart team as a whole

Remember: Any code suggestions you see here are merely suggestions. You assume full responsibility for your use of any such suggestions, including any impact ANY alterations you make to your site may have on your PCI compliance.
Furthermore, any advice you see here about PCI matters is merely an opinion, and should not be relied upon as "official". Official PCI information should be obtained from the PCI Security Council directly or from one of their authorized Assessors.

20 Sep 2012, 4:12 AM
#93
bypill avatar

bypill

New Zenner

Join Date:
May 2012
Posts:
4
Plugin Contributions:
0

Re: Simple CSS/PHP AntiSpam solution for a contact form

DrByte:

It's built-in to the core files (not addons) of the next release of Zen Cart.

Bad news for simple css/php antispam solution! It was broken by spammers and bad bots:
178.141.109.199
94.181.194.59
94.181.240.194
94.181.230.46
94.181.196.252
173.242.118.223
94.181.230.46
94.181.223.202
91.201.64.223
37.112.225.158
37.112.234.221
37.112.236.133
37.112.226.0
......

20 Sep 2012, 4:46 AM
#94
drbyte avatar

drbyte

Sensei

Join Date:
Jan 2004
Posts:
63,513
Plugin Contributions:
176

Re: Simple CSS/PHP AntiSpam solution for a contact form

It's no magic pill.

.
Zen Cart - putting the dream of business ownership within reach of anyone!
Donate to: DrByte directly or to the Zen Cart team as a whole

Remember: Any code suggestions you see here are merely suggestions. You assume full responsibility for your use of any such suggestions, including any impact ANY alterations you make to your site may have on your PCI compliance.
Furthermore, any advice you see here about PCI matters is merely an opinion, and should not be relied upon as "official". Official PCI information should be obtained from the PCI Security Council directly or from one of their authorized Assessors.

20 Sep 2012, 3:30 PM
#95
divavocals avatar

divavocals

Totally Zenned

Join Date:
Jan 2007
Location:
Los Angeles, California, United States
Posts:
10,011
Plugin Contributions:
3

Re: Simple CSS/PHP AntiSpam solution for a contact form

bypill:

Bad news for simple css/php antispam solution! It was broken by spammers and bad bots:
178.141.109.199
94.181.194.59
94.181.240.194
94.181.230.46
94.181.196.252
173.242.118.223
94.181.230.46
94.181.223.202
91.201.64.223
37.112.225.158
37.112.234.221
37.112.236.133
37.112.226.0
......
and regular CAPTCHAs can also be defeated.. They are not magic bullets.. they are deterrents which work MUCH MORE often than they fail..

My Site - Zen Cart & WordPress integration specialist
I don't answer support questions via PM. Post add-on support questions in the support thread. The question & the answer will benefit others with similar issues.

24 Sep 2012, 7:40 AM
#96
torvista avatar

torvista

Totally Zenned

Join Date:
Aug 2007
Location:
Gijón, Asturias, Spain
Posts:
2,875
Plugin Contributions:
7

Re: Simple CSS/PHP AntiSpam solution for a contact form

In addition to the honeypot field I also added a timer to my contact us/ask a question forms...if the form is submitted too fast (like 3 seconds) I treat it as spam.

Steve
github.com/torvista: BackupMySQL, Structured Data, Multiple Copy-Move-Delete, Google reCaptcha, Image Checker, Spanish Language Pack and more...

24 Sep 2012, 8:12 AM
#97
mcpisik avatar

mcpisik

Zen Follower

Join Date:
Jan 2007
Location:
Mount Maunganui, New Zealand
Posts:
417
Plugin Contributions:
0

Re: Simple CSS/PHP AntiSpam solution for a contact form

torvista:

In addition to the honeypot field I also added a timer to my contact us/ask a question forms...if the form is submitted too fast (like 3 seconds) I treat it as spam.
Is that easy to do?

24 Sep 2012, 1:27 PM
#98
lankeeyankee avatar

lankeeyankee

Totally Zenned

Join Date:
Jan 2007
Posts:
1,514
Plugin Contributions:
1

Re: Simple CSS/PHP AntiSpam solution for a contact form

torvista:

In addition to the honeypot field I also added a timer to my contact us/ask a question forms...if the form is submitted too fast (like 3 seconds) I treat it as spam.

Can you please post your timer code here so we can try it? This was working great for us, now in the past 2 or 3 days we are getting spam when we have never gotten a single one since implementing this. I wonder if that's because it was added to the core and has gotten the attention of spammers now?


Zen Cart and it's community are the best!!

25 Sep 2012, 8:36 AM
#99
torvista avatar

torvista

Totally Zenned

Join Date:
Aug 2007
Location:
Gijón, Asturias, Spain
Posts:
2,875
Plugin Contributions:
7

Re: Simple CSS/PHP AntiSpam solution for a contact form

I'll post the timer code asap...

Steve
github.com/torvista: BackupMySQL, Structured Data, Multiple Copy-Move-Delete, Google reCaptcha, Image Checker, Spanish Language Pack and more...

25 Sep 2012, 11:18 AM
#100
lat9 avatar

lat9

Administrator

Join Date:
Sep 2009
Location:
Stuart, FL
Posts:
14,114
Plugin Contributions:
56

Re: Simple CSS/PHP AntiSpam solution for a contact form

Would another obfuscation help here? What if there was a database setting that held the name of the "honeypot" field so that the name could be customized? That way, each store could have a unique input field name and, if the name was discovered and spam began arriving, it could be changed via the admin's console.