Re: email form injection


"Michael Vilain" <vilain@xxxxxxxxxxxxx> wrote in message
news:vilain-EEB790.22352004012009@xxxxxxxxxxxxxxxxxxxxxxxx
In article <gjrspj$e9h$1@xxxxxxxxxx>, ScriptKid <no@xxxxxxx> wrote:

[sanitising contact form fields]

You can also do something very simple. Name the fields some generic
name like field01, field02, field03... and code a hidden field like
"ZIP" with no default value. If your action script sees this field with
a value, you know the form was filled by a bot.

Client side "security" is less than worthless.

If a human fills out
the form and sends spam, reporting that is harder other than banning
that IP block. So far, the hidden field trick has worked on my contact
form.

How do you know it has "worked"?

If that doesn't work, you may have to go to a CAPTCHA:

http://www.captcha.net/

This is a joke, right?


.

Relevant Pages

  • Re: email form injection
    ... name like field01, field02, field03... ... the hidden field trick has worked on my contact ... Javascript can be turned off by a client browser and isn't what I'm ... The fields are validated ON THE SERVER by the action script ...
    (comp.lang.php)
  • Re: email form injection
    ... name like field01, field02, field03... ... the hidden field trick has worked on my contact ... filling in the CAPTCHA correctly (and occasionally I will run across ...
    (comp.lang.php)