Contact Form Spam - PHP

Shelly wrote:

> Why is this the problem?
>
> <input type="hidden" value="<?php echo $securityCode; ?>"
> name="securityHidden">

The problem is twofold:

1. The security code might be in a hidden field, but the field can still
be seen quite easily by viewing the source code to the page.

2. An even bigger problem: the client can change the contents of the
securityHidden field -- change it to "" for instance.

--
Toby A Inkster BSc (Hons) ARCS
[Geek of HTML/SQL/Perl/PHP/Python/Apache/Linux]
[OS: Linux 2.6.17.14-mm-desktop-9mdvsmp, up 25 days, 33 min.]

CSS to HTML Compiler
http://tobyinkster.co.uk/blog/2008/01/22/css-compile/

On Jan 24, 8:24 am, Toby A Inkster <usenet200...@tobyinkster.co.uk>
wrote:
> Shelly wrote:
> > Why is this the problem?
>
> > <input type="hidden" value="<?php echo $securityCode; ?>"
> > name="securityHidden">
>
> The problem is twofold:
>
> 1. The security code might be in a hidden field, but the field can still
> be seen quite easily by viewing the source code to the page.
>
> 2. An even bigger problem: the client can change the contents of the
> securityHidden field -- change it to "" for instance.
>

Thank you all for your help. I changed the storage mechanism to a
session variable and removed the hidden field from the form. I now
check the typed in version against that session variable's contents.
That variable gets changed with each presentation of the form.
Hopefully that fixes the problem. Thanks again everyone.

Shelly

<comp.lang.php>
<Shelly>
<Thu, 24 Jan 2008 05:01:42 -0800 (PST)>
<4cec3359-a419-4c37-a8c2-35eaa453836c@s13g2000prd.googlegroups.com>

> I looked at
> the html generated (view source) and there it is. The hidden field,
> its name, and its value are all to see. That means that they can
> generate a form and put in even a null field in that area and my check
> would fail because it matches. So, where do I hide the value to be
> checked? Do I create a session variable and put its value there and
> then check the returned value against that?
>

I use the ip address to create the filename and to store anti spam bot
code as a flat file - and then read the code in on the next page .

While its certainly not impossible 2 or more users will be surfing your
website using the same ip address - the chances that more than one user
will be using the contact form at that precise moment is quite remote
even if its a fairly busy website as the vast majority of users are
'surfers' and not 'contactors' .

www.jpgimage.co.uk/contact.php

BTW: one of the tricks IMHO is to write your own image code that you can
then use on any of your own websites - and despite what you might like
to think its not that hard once you learn some GD basics .

In article <fn9548$uqm$1@aioe.org>, Manuel Lemos <mlemos@acm.org>
wrote:

> Hello,
>
> on 01/24/2008 02:40 AM Shelly said the following:
> >>> The email is only sent to the site owner, so the spammer has no way of
> >>> knowing what the email should look like. That tells me that they have
> >>> to be going through the form. Yet the proper email has an echo of
> >>> generated security code. The spam email has that field empty. So,
> >>> that says he can't be going through the form.
> >>> It seems to me that they must:
> >>> 1 - Somehow diverting a legitimate email so that copy is sent to
> >>> them.
> >>> 2 - Using that email copy to create a template and modify the output
> >>> so that junk is sent.
> >>> I really don't know how they are doing it.
> >> If you are not using a good CAPTCHA, I am not sure what you mean by
> >> security codes.
> >>
> >> Anyway, I suspect that your code has a common vulnerability of contact
> >> forms which is to not properly encode information that goes to message
> >> headers. This means that if the abuser inserts a well throught character
> >> sequences, he may make your script compose a message that uses your mail
> >> server to send spam to anybody in the world.
> >>
> >> It is hard to advise without seeing your script. Anyway, I recommend
> >> using a component that knows how to properly encode or escape malicious
> >> character sequences to avoid abuses like your suffering.
> >>
> >> I use this MIME message composing and sending class that is well aware
> >> of all the e-mail standards that are necessary to compose messages
> >> properly. You may want to use it to avoid the abuses.
> >>
> >> http://www.phpclasses.org/mimemessage
> >>
> >
> > I use the class htmlMimeMail from http://www.phpguru.org/ by Richard
>
> I have not studied that class. I don't know if it properly encodes
> message headers.
>
>
> > Heyes. The security code is just a randomly generated string of 6
> > characters. I am not using a CAPTCHA. I guess I will have to.
>
> That may explain it. Even some CAPTCHAs can be bypassed with good OCR
> scripts. But even a basic CAPTCHA can raise the bar hard enough to make
> your abuser give up.

I use a very simple trick. Put a HIDDEN field with an obvious name like
"COUNTRY" or "POSTAL CODE" or whatever giving it an initially blank
value. Check in the post processing for the form to see that it's
blank, meaning the form was filled out by a browser with a human sitting
in front of it. If a bot filled out the form, chances are it put in a
value. Throw those submissions away and do nothing. Mail the others.

--
DeeDee, don't press that button! DeeDee! NO! Dee...

Just a heads up Shelly

Theres a free trial online of the pForms automated forms validator at
http://www.streamforensics.com the download link is on their introduction
page.(sorry I forget the actual page name)

It writes all the PHP code for you.

It is only a trial and you do need to buy the "data minion" software to
keep using it but its very interesting stuff for anyone with any sort
of web form. You might find it useful.

andy

I kind of like the new test you've been seeing here and there where it
says something like "2+2 = " and you enter the answer, seems like it
strikes more a balance between protection from bots and making the
form accessible to screen readers, etc.


---
www.NEXCESS.NET - Shared/Reseller Hosting
www.EliteRax.com - Dedicated Servers, Server Clusters
www.MaxVPS.com - Virtual Private Servers
- Great prices, Great service - check us out!

On Jan 24, 3:00 pm, Michael Vilain <vil...@NOspamcop.net> wrote:
> In article <fn9548$uq...@aioe.org>, Manuel Lemos <mle...@acm.org>
> wrote:
>
>
>
> > Hello,
>
> > on 01/24/2008 02:40 AM Shelly said the following:
> > >>> The email is only sent to the site owner, so the spammer has no way of
> > >>> knowing what the email should look like. That tells me that they have
> > >>> to be going through the form. Yet the proper email has an echo of
> > >>> generated security code. The spam email has that field empty. So,
> > >>> that says he can't be going through the form.
> > >>> It seems to me that they must:
> > >>> 1 - Somehow diverting a legitimate email so that copy is sent to
> > >>> them.
> > >>> 2 - Using that email copy to create a template and modify the output
> > >>> so that junk is sent.
> > >>> I really don't know how they are doing it.
> > >> If you are not using a good CAPTCHA, I am not sure what you mean by
> > >> security codes.
>
> > >> Anyway, I suspect that your code has a common vulnerability of contact
> > >> forms which is to not properly encode information that goes to message
> > >> headers. This means that if the abuser inserts a well throught character
> > >> sequences, he may make your script compose a message that uses your mail
> > >> server to send spam to anybody in the world.
>
> > >> It is hard to advise without seeing your script. Anyway, I recommend
> > >> using a component that knows how to properly encode or escape malicious
> > >> character sequences to avoid abuses like your suffering.
>
> > >> I use this MIME message composing and sending class that is well aware
> > >> of all the e-mail standards that are necessary to compose messages
> > >> properly. You may want to use it to avoid the abuses.
>
> > >>http://www.phpclasses.org/mimemessage
>
> > > I use the class htmlMimeMail fromhttp://www.phpguru.org/by Richard
>
> > I have not studied that class. I don't know if it properly encodes
> > message headers.
>
> > > Heyes. The security code is just a randomly generated string of 6
> > > characters. I am not using a CAPTCHA. I guess I will have to.
>
> > That may explain it. Even some CAPTCHAs can be bypassed with good OCR
> > scripts. But even a basic CAPTCHA can raise the bar hard enough to make
> > your abuser give up.
>
> I use a very simple trick. Put a HIDDEN field with an obvious name like
> "COUNTRY" or "POSTAL CODE" or whatever giving it an initially blank
> value. Check in the post processing for the form to see that it's
> blank, meaning the form was filled out by a browser with a human sitting
> in front of it. If a bot filled out the form, chances are it put in a
> value. Throw those submissions away and do nothing. Mail the others.
>
> --
> DeeDee, don't press that button! DeeDee! NO! Dee...