im getting lot of spam in websites, how can i solve this issue…??
im have tried few methods.
1.google recpatch.
2. try block country with ip address.
$IPaddress=$_SERVER['REMOTE_ADDR'];
$two_letter_country_code=iptocountry($IPaddress);
contiues.....
- Hidden fields…
<input type="hidden" name="secretField" placeholder="same as below" class="form-control" value="imnotspammer">
<input type="hidden" name="secretBlank" placeholder="same as above" class="form-control" value=""> Checking for input field:
if ($_REQUEST['secretField'] != 'imnotspammer'){ die('<h2 class="">Form Could not be submitted. Spam detected</h2>');
} if ($_REQUEST['secretBlank'] != ''){ die('<h2 class="">Form Could not be submitted. Spam detected</h2>');
}
- Filtering Spam words.
$spam_words = ['f*ck', 'bitch','ww','cum','hacker','money','Buy','Order','Meet singles','Near you','Near you','Additional income','Be your own boss','Robot','More Internet Traffic','Performance','Sale','Sales','Search engine listings','Search engines','Subscribe','Visit our website','Web traffic','traffic','100%','satisfied','Giving away','Warranty','Winner','Winning','won','Sleazy','Shady','Prize','Guarantee','free','Double your','Hurry up','Offer expires','crypto','Cryptaxbot','@Cryptaxbot','Exclusive deal','Compete for your business', '<','>' ];
all four method in single form but still getting spam mail…
First off, you’ll never filter out all spam. The thing is are your methods working? Are you still getting spam with the stop words you are checking for and from the countries you’re filtering out?
Personally I wouldn’t let the spammer know that you have detected spam. It gives them the chance to edit their spam to get round your checks. Let them think the email has been sent and they’ll go on to the next spamee.
You could try, what I have recently learned is called a form honeypot. Create a check box on the form with the text eg “I accept the terms and conditions” but with CSS style it
display: none;
so that humans can’t see it but a bot will and will then check it. Then when processing the form simply don’t proceed with the sending of the mail if the box has been checked.
I’ve noticed that some bots have learnt to get around Recaptcha. That is the problem with common Captcha types, they are the one they are working on cracking.
These are usually effective in my experience.
Agreed, thet them think they have won, when if fact they have not. And don’t give them clues as to the purpose of the hiiden honeypot inputs. Using type="hidden" tells them they shouln’t see it.
The hidden inputs are honeypots.
Another one that I have found very effective is a form timer. Record the time on the form request. Record the time of submission. Compare the two to get the time elapsed. If it is below a value you set, consider it a bot.
You can also use an access token, to stop those who spoof your form on their own machine and send the submission request to your server. A random string (different every time) in a hidden input. It is recorded and passed to the validation script, then compared against the value submitted from the form.
A good combination of methods used together canwork.
This is called Cross Site Forgery Request token, or CSRF token for short.
Funny, I knew there was a term for it, but could not remember what it was called, just how to doit.
Besides bad words also check text for unwanted url parts like '<','http','www','.com','http:','@' etc.
I have an old list (many years ago) of agent/spiders and a snip of code I used. As it is a long list I put it on a file and uploaded it. This was one of the first checks I did. I also had a database table blockedips to hold a list of ips that I blocked and I would query this table and put these ips into an array $badips. This code was all on a file that was included on all my pages before output to the browser so if it is a blocked ip they just wouldn’t have access at all.
if(in_array($ip_address,$badips)){ header("Location: http://www.google.com/"); exit;
}
So before doing any text searches for bad words they have to pass the spider test and my blockedips list with this simple IF condition.
if(!in_array($ip_address,$badips) && isset($nobot)){ //Band word check
}
If text did not pass the word check I would save their ip address and date into a database table called ip_tracking then I query the ip_tracking table using today’s date and the ip address and I count the records. I set a threshold of 75 and if this count is surpassed, their ip was added to the blockedips table. Bots can hit your form rather quickly and I caught many at this setting. Anyway this is what I did many years ago on a site… I am sure other might have a more modern approach.
spiders.php (8.2 KB)
Another check that can detect form spoofing, and really should be part of any robust validation system is checking all the inputs and values are as they should be.
You can create a function to check each input in turn. Start with an array of all the form’s inputs, then check if each one isset(). In a valid subission from your site all should be set (with the exception of checkboxes) but spoofed forms may miss some inputs out.
Then with the values, some values are pre-set in the form, such drop-down selects, radios and checkboxes. Check the submitted values for these against an array of proper values that you have offered as choices. Bots will often tamper with the pre-set values, an honest user would not do this, so the bots give themselves away doing this.
Again all part of the validation process, but checking user input matches the type and obays any contraints will catch out the bots. Eg, checking a string obays any min/max length constrints, also min/max numerical inputs, required inputs are !empty().
Basically every constraint you put on form inputs has to be checked in validation, and bots will reveal themselves by not adhering to those constraints.
Techyrack Website stock market day trading and youtube monetization and adsense Approval
Adsense Arbitrage website traffic Get Adsense Approval Google Adsense Earnings Traffic Arbitrage YouTube Monetization YouTube Monetization, Watchtime and Subscribers Ready Monetized Autoblog
from Web Development – My Blog https://www.techyrack.com/syndication/2022/11/11/how-to-solve-spam-mail-issue-php-sitepoint-2/
via IFTTT
No comments:
Post a Comment