6

I have compiled a list of items that may protect a web form from span. Which are actually effective? Please feel free to add additional items.

  • Store a code as a hidden field and verify it when submitted.
  • Use jQuery to set the method and action fields after page loads.
  • (Also) Use jQuery to encode the action URL
  • Encode the entire webform and use jQuery to decode it after the page loads.
  • Use AJAX instead of the standard submit button action.
  • Use CAPTCHA
  • Place CSS-hidden fields of the form that only bots will find and fill in.
  • Recording time between page load and submission, ignore if less that 1 second.
  • Load the form into the page via AJAX, one second after page loads.
Hoytman
  • 459
  • 1
  • 5
  • 12
  • Just a curiosity question: Is there a reason why captcha is not on your list? Is there a problem I am not aware of? Is there a failure rate of some kind that allows some bots to get through? – closetnoc Mar 24 '14 at 16:23
  • There is no failure yet. Captcha is great, and I may end up using it, but I wan to see if I can stop spam by making the form unrecognizable to bots. – Hoytman Mar 24 '14 at 17:03
  • Gotcha! Good idea. Quite clever actually. I will keep an eye on what you learn. I removed all forms from my sites because it was a target more than anything. That was a long time ago. – closetnoc Mar 24 '14 at 17:09
  • Effective against what? There are bots that try to submit any form they find and there are bots that specifically target your site to to create accounts. There are also XSS attacks that attempt to make your users' browsers submit forms without their knowledge. – Stephen Ostermiller Mar 24 '14 at 20:46
  • Please let me know which safe-guards are effective against which attacks. That would be a great help. I'm probably not even aware of many of the modes of attack that are out there. – Hoytman Mar 24 '14 at 21:02

2 Answers2

3

By far my favorite technique is called a 'honeypot'. Here is how it works...

Say your form asks for a name. Put the following two fields on the page:

<span class='hp'>
  <label for='Message'>Message:</label >
  <textarea id='Message' name='message' />
</span>
<span>
  <label for='TmpField'>Message:</label >
  <textarea id='TmpField' name='tmpField' />
</span>

Make the first span with the class hp hidden via CSS. That is the honeypot. The bot won't see CSS, so will try to fill in the message field before submitting the form. Users will only see tmpField, and will input their message there. (Obviously your form processing code has to be in on the ruse.)

In your form processing code, simply throw out any input where the message field contains content. Ignore it. Continue along as though nothing had happened. You definitely don't want to tell the spammer bot "Oh, that didn't work" so that they can try again.

Here at Glassdoor, we find that this technique removes nearly ALL spam through our forms.

Zistoloen
  • 10,036
  • 6
  • 35
  • 59
Ron Lussier
  • 51
  • 2
2

From my personal experience, I have found that CAPTCHA is virtually ineffective when it comes to preventing spam attacks. What I use and I found to be the most useful is adding a field to the form and covering it with CSS so that it is not exposed to human visitors. Spam bots feed value to these fields and can be blocked easily. It is simpler than any of the alternatives you provided, sleek, highly effective, works great with people who does not have ajax/js and does not affect user experience(unlike CAPTCHA).

Rana Prathap
  • 826
  • 4
  • 21