Garbage Spammers

Spammers use bots to try to send spam via email forms of Webpages. All automatic. What you need to do is harden your code so the bots can't submit the forms. Use captcha or a similar code which deters automatic form filling and submission. And you should also use code to prevent header injection and carriage returns in all the form fields except the message textarea.

I use php on my sites and require the user to enter the answer to a math question, such as 5 + 11 = ___ and the user must type the correct answer. If the answer is incorrect an error is displayed and the user bounced. Most bots are dumb and don't do calculations.

example form field:

Code:

<p>12 - 5 = <input type= "text" id= "math_question" name= "math_question" size= "2" maxlength= "1" value=" "> <a href= "javascript:void()" onclick= "alert('Math Question\n\nHelps prevent automatic spam programs from using this form.'); ">what's this?</a></p>

and the php:

Code:

<?php
if ($_POST['submit'] == TRUE) { //if submit button pressed process form
$recipient		= stripslashes(strip_tags($_POST['recipient']));
$sender_name		= stripslashes(strip_tags($_POST['sender_name']));
$sender_email		= stripslashes(strip_tags($_POST['sender_email']));
$subject		= stripslashes(strip_tags($_POST['subject']));
$message		= stripslashes(strip_tags($_POST['message']));
$math_question		= stripslashes(strip_tags($_POST['math_question']));

//prevent header injection, bounce to google if fields contain carriage returns
if (ereg( "[\r\n] ", $recipient) || ereg( "[\r\n] ", $sender_name) || ereg( "[\r\n] ", $sender_email) || ereg( "[\r\n] ", $subject) || ereg( "[\r\n] ", $math_question)) {
echo  "<meta http-equiv='refresh' content='0;url=http://www.google.com'> ";
}

$answer	= '7'; //correct answer to math question
if($math_question != $answer) { //if incorrect answer to math question
//ack sender and redirect back to home page in 3 seconds
echo  "<h3>Incorrect!</h3> ";
echo  "<p>12 - 4 does not = <span class='red'>$math_question</span></p> ";
echo  "<meta http-equiv='refresh' content='3;url=/'> ";
?>