HTML form post to PHP and avoid spamming

[rrsub]

There are several ways to avoid spambots from hijacking a form when the form originates in PHP and is posted to PHP.

How can I prevent spamming from HTML to PHP.

 

[sleipnir214]

I don't understand the question.

Want the best answers? Ask the best questions!

TANSTAAFL!!

 

[rrsub]

OK

You have a form in HTML that sends a name
---
<form action="action.php" method="post">
<input type="text" name="variable">
<input type="submit" value="submit>
</form>
---

With that , anybody can write a html doc on their system, or a bot can write to action.php a $_POST['variable'] on the hosted server.

In PHP, spamproof code could be:
---
<?PHP session_start();?>
<form action="action.php" method="post">
<?PHP
print "<input type=\"hidden\" name=\"sid\" value=".session_id().">";
?>
<input type="text" name="variable">
<input type="submit" value="submit>
</form>
---

Where action.php verifies that the session_id is the same.

I'm looking for any solution that makes sure that any form submitted was from the website from an actual visitor.

 

[sleipnir214]

If the form is on a static HTML page, there's not much you can do.

Want the best answers? Ask the best questions!

TANSTAAFL!!

 

[skiflyer]

Granted, you can't guarantee anything... and you may kick out legitimate users, but you can use the $_SERVER['HTTP_REFERER'] variable.

But to quote the PHP manual

The address of the page (if any) which referred the user agent to the current page. This is set by the user agent. Not all user agents will set this, and some provide the ability to modify HTTP_REFERER as a feature. In short, it cannot really be trusted.

 

[jimoblak]

How can I prevent spamming from HTML to PHP.

Can you do PHP to PHP? Establish a session with a PHP form and then check to make sure that the session has started when you process the form.

- - picklefish - -
Why is everyone in this forum responding to me as picklefish?

 

[rrsub]

That's what I'm trying to avoid. I'd like to have the PHP script verify that the request came from the server.

 

[jimoblak]

I guess the question is 'why must your form be HTML instead of PHP'?

You can drop cookies with plain old HTML.

- - picklefish - -
Why is everyone in this forum responding to me as picklefish?

 

[rrsub]

Different developers are writing the form pages. They're asking me to do stuff with the data.

I just may have them code the page and change the extention to php.

 

[jimoblak]

This may be your best option. If you provide them the PHP code snippet to place at the start of the HTML, they should have little problem. Better WYSIWYG editors like Dreamweaver and GoLive will hide the PHP in the layout view. They may easily forget that they have PHP in their HTML.

- - picklefish - -
Why is everyone in this forum responding to me as picklefish?