If those alternatives are not good for you you can do what I do in my blog. As bots usually do not support JavaScript, create a hidden field that has an empty value and a name of a common field (age, for example).
Code: Select all
<input type="hidden" name="age" value="">
Then, with JavaScript, modify the value of this field to an arbitrary one via an event listener.
Code: Select all
document.querySelector('button[type="submit"]').addEventListener('click', _ => {
document.querySelector('input[type="hidden"][name="age"]').value = 5063;
});
Then in your backend you just have to check that that value is what you expected. If it is not, just return a blank page so that bots can't go back and try to fix the form.
Code: Select all
if(!isset($_POST['age']) || intval($_POST['age')] !== 5063) { // Or equivalent method in your platform / framework
die();
}
The only problems with this method are:
- It's too simple. It won't prevent bots that are made specifically to attack your site, as bypassing it is pretty simple. However, if you get more SPAM you would know somebody is attacking you on purpose.
- Users that do not have JavaScript support would instantly considered spammers and wouldn't be able to complete the forms. This shouldn't be a problem in most cases as every single browser nowadays supports JavaScript but still should be something to consider.
If those alternatives are not good for you you can do what I do in my blog. As bots usually do not support JavaScript, create a hidden field that has an empty value and a name of a common field (age, for example).
[code]<input type="hidden" name="age" value="">[/code]
Then, with JavaScript, modify the value of this field to an arbitrary one via an event listener.
[code]document.querySelector('button[type="submit"]').addEventListener('click', _ => {
document.querySelector('input[type="hidden"][name="age"]').value = 5063;
});[/code]
Then in your backend you just have to check that that value is what you expected. If it is not, just return a blank page so that bots can't go back and try to fix the form.
[code]if(!isset($_POST['age']) || intval($_POST['age')] !== 5063) { // Or equivalent method in your platform / framework
die();
}[/code]
The only problems with this method are:
[list][*]It's too simple. It won't prevent bots that are made specifically to attack [b]your[/b] site, as bypassing it is pretty simple. However, if you get more SPAM you would know somebody is attacking you on purpose.
[*]Users that do not have JavaScript support would instantly considered spammers and wouldn't be able to complete the forms. This shouldn't be a problem in most cases as every single browser nowadays supports JavaScript but still should be something to consider.[/list]
