Simple CSS/PHP AntiSpam solution for a contact form

schoolboy:

The point many people miss is that the website - while being an "easy" way to order goods - is just another sales channel. Many people put up their website and then "sit back" hoping that the orders will just roll in regardless. They hide their phone number, they don't provide an address...
I don't understand. I didn't hide the telephone, and I didn't provide an address for my business simply because I don't have one.
I have also provided alternative ways to contact us: by email, FB Messenger, FB fan page, Twitter, You Tube channel, besides the telephone number.
All I was looking for was to cut only the contact us form, and leave the rest page alone with the alternative ways to contact us.

I will try instead the advice yaseent gave me. Hopefully don't break anything instead! :)

I have allready changed the SPAM tags, I need a little help with the next steps:

yaseent:

What I would do in your case is changed the name of the field, and the name of the function that tests for that field's input.
Change all instances of "leaveblank" to "Telephone".

By all instances, did you mean exactly that, ALL instances?
E.G.: in

// NO SPAM
  $leaveblank = zen_db_prepare_input($_POST["leaveblank"]);
  // NO SPAM

both "leaveblank" should be changed?

yaseent:

... and the name of the function that tests for that field's input...
The name of the function is "leaveblank"?

yaseent:

Also, give it an ID or a class, and add this class to your Stylesheet, and apply "display:none;visibility:hidden" - and remove it from the inline styling for now.
Could you help me with that too?
Thank you in advance!

mario75:

I don't understand. I didn't hide the telephone, and I didn't provide an address for my business simply because I don't have one.
I have also provided alternative ways to contact us: by email, FB Messenger, FB fan page, Twitter, You Tube channel, besides the telephone number.
All I was looking for was to cut only the contact us form, and leave the rest page alone with the alternative ways to contact us.

I think what Schoolboy said was not specifically directed at you. Just giving tips on giving customers as many ways to contact you as possible. With the Contact Us form, there's no effort required on the customer's part. They don't even need to log in, they're already there. It makes them nice and lazy ;) And gives them a quick lazy way to get in touch with you.

By all instances, did you mean exactly that, ALL instances?
E.G.: in

// NO SPAM
$leaveblank = zen_db_prepare_input($_POST["leaveblank"]);
// NO SPAM

> both "leaveblank" should be changed?
> 
> 
> The name of the function is "leaveblank"?

Sorry, what I meant was, change "leaveblank" that is in the function, not the function lol, so make it this:

```php
  $leaveblank = zen_db_prepare_input($_POST["telephone"]);

You can leave the variable "$leaveblank" - that's a variable that the frontend does not see. So only change the $_POST["leaveblank"] to $_POST["telephone"]

And then, in /includes/templates/YOUR_TEMPLATE/templates/tpl_contact_us_default.php

Change:

<!-- NOSPAM -->
<input style="visibility:hidden; display:none;" name="leaveblank" type="text">
<br class="clearBoth" />
<!-- NO SPAM -->

to:

<!-- CSSNS -->
<input style="visibility:hidden; display:none;" name="telephone" type="tel" autocomplete="off" id="nstelephone">
<br class="clearBoth" />
<!-- CSSNS -->

Let's leave out the Stylesheet additions for now.

But if the problem continues, then add the following to your Stylesheet.css file at the very bottom:

#nstelephone
{
display:none !important;
visibility: hidden !important;
}

AND re-edit the code in in /includes/templates/YOUR_TEMPLATE/templates/tpl_contact_us_default.php to this:

<!-- CSSNS -->
<input name="telephone" type="tel" autocomplete="off" id="nstelephone">
<br class="clearBoth" />
<!-- CSSNS -->

Thank You very much for help. Will do a.s.a.p. :bow:

yaseent:

It worked!
I did all your edits and it worked!
I have implemented ALL your edits including Stylesheet additions from the first time, and it has been almost two days since no spam arrived from "contact us" page. I know it would have been better if I have done it in two steps in order to see which steps worked better, but I didn't want to teach the bots what I have done, nor to waste any time.
The form remains in place!
Thank you!

Found this just recently and I am intrigued. I started to get contact us spam even with captcha on v1.5.4. Now was this Simple CSS/PHP AntiSpam solution integrated in the newest 1.5.5d code? I did a search with developer kit and could not find any code from the suggested changes. What is the status?

mydanilo:

Found this just recently and I am intrigued. I started to get contact us spam even with captcha on v1.5.4. Now was this Simple CSS/PHP AntiSpam solution integrated in the newest 1.5.5d code? I did a search with developer kit and could not find any code from the suggested changes. What is the status?
The change, in /includes/templates/template_default/templates/tpl_contact_us_default.php, has been provided since Zen Cart 1.5.1's release.

lat9:

The change, in /includes/templates/template_default/templates/tpl_contact_us_default.php, has been provided since Zen Cart 1.5.1's release.

Thanks, so now I have to find out how spam still is going through. It is not a lot but I wonder if it is done by hand or by bots. They all go something like this:

wh0cd174777 prednisone 5mg tablets generic tadacip clonidine propranolol isoniazid clindamycin 

Seems to originate from Russian Federation, 46.161.9.20 and Poland 155.133.38.215.

Do you folks still get this kind of spam despite the new measures taken?

I've installed CAPTCHA mod and a quick check reveals that I must have merged the new code out :(. Need to fix this or just not install CAPTCHA during upgrade to 1.5.5d. It looks like the CAPTCHA alone seems to let some spammers in anyway.

mydanilo:

Do you folks still get this kind of spam despite the new measures taken?

I got human spam sometime back, but I use a email blocker and that stopped it. The new methods deployed in ZC 1.5.x is one of three levels of honeypot's. The three levels, input test, question test, and confirmation test. I do both input and confirmation test with the mega menu. I tend to avoid the eye test method (CAPTCHA).

I also had a host that couldn't protect there mail server which was letting spoof spammers in bypassing everything I was doing.

If you don't do business in those countries, you can also block IPs in your htaccess. I have blocked a lot of countries that we don't sell to due to high levels of fraud and that has coincided with many spammer's servers. If we ever get a spam, maybe 3 or 4 a year, I also block their IP.

lankeeyankee:

If you don't do business in those countries, you can also block IPs in your htaccess. I have blocked a lot of countries that we don't sell to due to high levels of fraud and that has coincided with many spammer's servers. If we ever get a spam, maybe 3 or 4 a year, I also block their IP.

Done this on another site and will do it again. Thanks for the reminder.