Skip to main content
A
Anonymous
April 12, 2010
Answered

Securing an Email Form (PHP)

  • April 12, 2010
  • 2 replies
  • 1531 views

Good Morning Everyone,

Over the weekend an email form on my webpaged was, for lack of a better term, hacked.  They were filling out erroneous information and even able to change the subject of the email which is stored in a hidden field on the page.  It was nothing major, just more annoying than anything else.

I know that I could add CAPTCHA images to the page but at this point I don't want to change how the user fills out the form.  So I was wondering if there was anything standard flags that I could check for using PHP that would help filter out spam attacks.


I attached a link to the form in case anyone needs it.

http://www.powerhouse.com/Products/RequestInfo.php?UnitNumber=B-862

Thanks for the help everyone!

This topic has been closed for replies.
Correct answer bregent

>Also add a field that is hidden using css.

This works well for me. The OP can search the web for "honeypot form" for more details.

2 replies

pziecina
pziecina
Legend
April 12, 2010

Hi

The way I have gone with this problem is to create a simple text input box at the bottom of the form and asked the user to input a 3 digit code, then used a simple if/else in my form processing script to check for the code.

The advantage of this over captcha is that it is accessible to users with disabilities and I can change the '3 digit code' at any time. Not as secure as captcha but unless you have a 'determined' spam bot visit your page that reads the instructions on the page, it does work and is simple to implement.

PZ

A
Anonymous
April 13, 2010

Also add a field that is hidden using css. If that field has data then you have someone reading the page and filling it out who has css disabled. Meaning that it is likely a bot putting garbage in all fields. Simply through away the data without sending an email.

You can also do a domain check - if you are using php - to make sure it is a valid domain entered for the email address. Again, discard if not.

B
bregentCorrect answer
Participating Frequently
April 14, 2010

>Also add a field that is hidden using css.

This works well for me. The OP can search the web for "honeypot form" for more details.

M
Mayga58
Participant
April 12, 2010

Captcha is the better way... but you can create your own form and ask a simple question

to answer. It will not destroy your design


Terms & ConditionsAccessibility statement
Using the community Terms of use Privacy Cookie preferences Do not sell or share my personal information ad choicesAdChoices