Zen Cart Logo
Forums / All Other Contributions/Addons / Trying to use CSS/PHP to fight spam

Trying to use CSS/PHP to fight spam

Views: 681

Results 1 to 1 of 1
23 Sep 2011, 11:05 PM
#1
feznizzle avatar

feznizzle

Totally Zenned

Join Date:
Apr 2010
Posts:
900
Plugin Contributions:
0

Trying to use CSS/PHP to fight spam

Hello All!

General Info:
CSS/PHP can be used as an alternative to CAPTCHA mods in the effort to fight against automated attacks. The way it works is you add an input to your forms, then use css to hide the input. A robot will try to fill in all entries. Therefore, since the human eye cannot see the hidden field, if that field receives input then a robot filled it out.

This is great because it means that you should be able to use forms (Contact Us, Tell a Friend, etc) without forcing your customers to use their brains!

Additional Information:
I have been attempting to accomplish this feat while using information found here: Simple CSS/PHP AntiSpam solution for your contact form

What I would like to accomplish:
I want to create a fairly clear set of instructions. My hope is that a more senior Zenner will take some time and really help think this thru. I know a lot of people will be VERY grateful... me especially!
:D

What I am going to do first is to put up my translations of the instructions given in the other thread and explain the results. I have a ZC 139h.

+++++++++++++++++
dlg_ie's instructions (my take, anyway!)

PART 1:
/includes/templates/template_default/templates/tpl_contact_us_default.php

*** Add the new hidden field somewhere like between existing fields around line 70 (BEFORE </fieldset>): ***
<input style="visibility:hidden; display:none;" name="leaveblank" type="text">

PART 2:
/includes/modules/pages/contact_us/header_php.php

FIRST
*** After the line: ***
$enquiry = zen_db_prepare_input(strip_tags($_POST['enquiry']));

*** Add this: ***
$leaveblank = zen_db_prepare_input($_POST["leaveblank"]);

SECOND
*** Find this (around line 24): ***
if ($zc_validate_email and !empty($enquiry) and !empty($name)) {

*** Replace with this: ***
if ($zc_validate_email and !empty($enquiry) and !empty($name) and !empty($subject) and empty($leaveblank)) {

THIRD
*** After this line (around line 80): ***
if (empty($enquiry)) {
$messageStack->add('contact', ENTRY_EMAIL_CONTENT_CHECK_ERROR);
}

*** add this test that kills the page if the field was not empty, i.e. filled in by a bot: ***
if (!empty($leaveblank)) {
exit;
}

PART 3:
To verify, you can install the firefox extension WebDeveloper, disable Inline CSS and add something to the now-not-hidden field.

RESULTS
When I submitted the form as a human, nothing happened. When I disabled css and submitted the form with extra info, nothing happened.
+++++++++++++++++

+++++++++++++++++
dw08gm's instructions (my take, anyway!)

I tried this six ways to Sunday, the one I am putting up now yielded the best of the lousy results. :frusty:

PART 1:
/includes/templates/template_default/templates/tpl_contact_us_default.php

*** Add the new hidden field somewhere like between existing fields around line 70 (BEFORE </fieldset>): ***

<div style="visibility:hidden; display:none;"> <label class="inputLabel" for="confirm_email">Confirm Email: </label> <input id="confirm_email" name="leaveblank" type="text"><span class="alert"><strong> * </strong></span> <br class="clearBoth" /> </div>

PART 2:
/includes/modules/pages/contact_us/header_php.php

*** After this line (around line 80): ***
if (empty($enquiry)) {
$messageStack->add('contact', ENTRY_EMAIL_CONTENT_CHECK_ERROR);
}

*** add this test that kills the page if the field was not empty, i.e. filled in by a bot: ***
if (!empty($leaveblank)) {
zen_redirect(zen_href_link(FILENAME_WHATEVER, 'action=success'));
}

PART 3:
To verify, you can install the firefox extension WebDeveloper, disable Inline CSS and add something to the now-not-hidden field.

RESULTS
When I submitted the form as a human, I was super excited to receive an email! When I disabled css and submitted the form with extra info, I was super excited to see the SUCCESS page come up (as advertised). But then I was devasted to actually receive the email!
+++++++++++++++++

At the time I posted, my website was still using dw08gm's method. Here it is: My Site

Can somebody please look at the two methods above and tell me what I'm doing wrong?

Thank you so much, I know this is a super complex issue!

~Mike