Form Security and Spam

[motoxxx]

Re: Form Being Spammed

Thanks BeeBrothers. The grey on grey was a CSS thing I was playing with for conversion on an old test page. I just forgot to remove it. Thanks.

The link in affordablemedicaldental.com/contact.html isn't the problem at all. I may change it to a button anyway just to be safe.

The biggest probelm is the forms getting spammed. I am getting about 100 a day now. Very frustrating.


Andy, I did use your form and I have shortened my field charachter lengths as well and I am still getting them. Tomorrow I am on a mission to get this solved. I have another more important project that needs my attention for today.

Thanks every one so far....

I'll check in tomorrow after I try all of this further.

[motoxxx]

Re: Form Being Spammed

Andy, I looked at the captcha on your form and I know I can make the image with the numbers on it and place it on the form. My question is how do I make it mandatory that it be filled in exactly?

I am really new to web stuff and script and this security part is giving me a bit of a head ache.....

You folks are all awesome!

[Andy128]

Re: Form Being Spammed

Simply ad the captcha jpg or gif onto the form. Then create a text field
underneath it and name the field- captcha

Then in your script- declare that 'captcha' gathered from the form will
be stored in the variable $captcha. Then declare that the numbers will
be stored in a variable named- $security_code. Then test for it like so;

$captcha = $_POST['captcha'];
$security_code = "69234";
if ($captcha == "")
{
echo" You have failed to enter any numbers at all. Please do so
for security reasons. Thank you!";
}
elseif ($captcha != $security_code)
{
echo" The numbers you entered do not match those present on
the form. Please try again.";
}


If they entered the correct code- the script would simply continue on.

Hope that helps.

Andy
PS- if it is a true injection and they are using your form- Then by limiting the number of characters in the php script (NOT ON THE FORM) will prevent them from sending out tons of e-mails.

[Vasili]

Re: Form Being Spammed

Hello, My Friend!

Question:
Do you still have your previous version of validated email form (the one where you can create separate pages for acknowledgement, error, etc. rather than the simplified version now up on your site)??

Like the one done at WordPointe.com??? It is easier for me than Naval's Grand Plan, and seemingly more "customizable" than your updated one-page-processing version......

[Andy128]

Re: Form Being Spammed

Vasili-

Yes- actually, it is rather simple. For each error you will create a specific
error page and then instead of echoing the error in a statement, you will simply redirect to that specific error page. It would look like this;

For example to check if a field is left empty:

if ($name == "")
{
header("Location: name_error.html");
}
elseif
{

Is this what you are referring to?

Andy

[navaldesign]

Re: Form Being Spammed

Vasili,

if you want, just give me the necessary details and i will install ABVFP for you in no time.

[navaldesign]

Re: Form Being Spammed

Motoxx,

what is yet not clear to me is the fact that you say your form is being spammed because you get hundreds of spam mails.

Please explain: are these spam mails sent to you through your form ? Or are they simple emails ?

I have more than 30 forms published on the net, both for my sites and for VH turorials purposes, and i have only received 3 spam emails through my forms in 2 years.

Spammers don't loose their time in using your form just to send spam to you. If they use your form script, it will be for sending mass spam to third parties.

On the other hand it is easy to verify if these emails are sent through your form, or by directly emailing you. That's because when a mail is sent through your form, there is some standard text (the field names) that will also be mailed to you.

Please post here one of these emails, so we can have a look.

[Vasili]

Re: Form Being Spammed

I too, have made the conceptual leap to Forms to minimize spam, and I get at least 2 per day from the forms I am presently using (many more from sites where I have yet to convert all Contact to Forms). Altugh they come in one at a time (as mentioned, getting the "carbon copy" of spam campaigns), I am puzzled at how they still come through with non-provided addresses: I don't have personal names, or "info@" addresses for example.

Interestingly enough also, I only get his spam activity from sites here at VH. Not wlling to open the dscussion that Carlos started, I am left to wonder besides locking down all email to Contact forms with only one "@" symbol in them, what more can I do to truly move past this potentially crippling side effect of being online???

I think I WILL take you up on your offer, General.....I must first write down all the logistics (I have quite a lot of Forms to be installed) to make the organization very clear and a "single-session" project for you to evaluate prior to committing to such an compensatable effort. Only then will I need to dutifullly study the Form cPanel to understand completely for further developments, for I think that once the immediate "problems" are solved, this will enable me to solidly progress in all my future projects.

PS: Why is this thread so hard to locate?? I only found it in the first place by following Keith's post, and can only return to it by tracing my own posts? It doesn't even show up on the board as active???

[navaldesign]

Re: Form Being Spammed

Vasili,

ABVFP is VERY easy to use. After installation, you simply run, for every form, the admin interface and you provide, typing, very simple information: the site, the form url, the subject of the email that you will receive, as well as that of the autoresponder email (that your user will receive), the headers and the footers of these emails.

That's ALL ! When you want, i'm at your service General!

Ah! the thread is actually moved to a "cleaning" zone by *****. After "cleaning" it will go babck in it's place.

[Vasili]

Re: Form Being Spammed

Kataleveno, General. Soon.....

Eγώ Ευχαριστώ!

[motoxxx]

Re: Form Being Spammed

Naval, what is happening is that a Prescription Drug vendor has hijacked my forms somehow. I get these forms submitted to me from all of my sites everyday from clients. The form will come into my commercial Yahoo email account (forwarded from BV) just like it was a lead from any normal customer The fields are completed like someone had filled them out complete with email address, age, sex, type of insurance coverage desired etc.... Then in the "Comments" section there is a short note such as "Nice site, it is the best" or something really stupid, then there are links to approximately 50 different links to a database that the main vender is using as a link hub for their affiliates.

So over the last couple of days I have shortened the characters that each field will accept, changed the name of each field to see if I could confuse any bot that may be auto populating the fields etc. Still I am getting the emails....although on a few of them, the form fields that I renamed are now not being auto populated, they are being left blank or to <default>


Here is a copy of one of the these things....This one just came in...


AZ Health Ins Quote:
enam : <Default>
liame : <Default>
mabell : <Default>
****tywok : <Default>
nada : <Default>
Sex_Primary : Female
Your_age : 18
Primary_Tobacco: : ----
Sex_Souse : Male
Spouse_age : 18
Spouse_Tobacco: : Yes
Children : 1
Desired_Coverage : Major medical coverage
Current_Ins? : Continental General
Coverage_to_begin: : ASAP
saywhat : Great .Now i can say thank you!
<a
href=\"http://www.nsula.edu/itac/_disc1/00000032.htm?******\">******</a>
http://www.nsula.edu/itac/_disc1/00000032.htm?******
http://www.nsula.edu/itac/_disc1/00000032.htm?******]******[/url]
<a
href=\"http://www.keuka.edu/faculty/grn301/_discuss/0000002e.htm?tramadol-online\">tramadol
online</a>

http://www.keuka.edu/faculty/grn301/_discuss/0000002e.htm?tramadol-online

http://www.keuka.edu/faculty/grn301/_discuss/0000002e.htm?tramadol-online]tramadol
online[/url]
<a
href=\"http://www.sophiasolutions.net/feedback/_feedback/00000029.htm?cheap-******\">cheap
******</a>

http://www.sophiasolutions.net/feedback/_feedback/00000029.htm?cheap-******

http://www.sophiasolutions.net/feedback/_feedback/00000029.htm?cheap-******]cheap
******[/url]
<a
href=\"http://www.sophiasolutions.net/feedback/_feedback/00000028.htm?buy-******\">buy
******</a>

http://www.sophiasolutions.net/feedback/_feedback/00000028.htm?buy-******

http://www.sophiasolutions.net/feedback/_feedback/00000028.htm?buy-******]buy
******[/url]
<a
href=\"http://student.darden.virginia.edu/jpOffice/ask_detail/00000642.htm?******\">******</a>

http://student.darden.virginia.edu/jpOffice/ask_detail/00000642.htm?******

http://student.darden.virginia.edu/jpOffice/ask_detail/00000642.htm?******]******[/url]
Contact_by : Email
Contact_Time : Late Afternoon 2-4pm
AZ_Health_Ins_Quote_INDEX : Yes, Contact Me!



These aren't going anywhere excpet to me. You can see in the fields that I changed the name of
that the bot left these to <Default> I changed the field names to be:
eman = name
nada = zipcode
eliame = email
comments = saywhat
Something is still selecting some of the multiple choice options. and submitting.

[navaldesign]

Re: Form Being Spammed

your form is used to send spam directly to you. This is something that you cannot avoid. It is excactly the same as if they had your email address and were sending you automated messages. Noone can stop a spammer from emailing directly. Anyway, i need some more info. Can you please give me the link to your form that has been used to send you the above email ?

[navaldesign]

Re: Form Being Spammed

Motoxxx,

i just realized, by visiting one of your sites, that you are NOT using ABVFP

I'm telling this because your form script is, i beleive, automatically spammed (by a bot). I don't beleive they take the bother to fill in manualyy your forms 100 times a day.

if this is the case, ABVFP will save you, because it performs a illegal form submission check. If it finds that the submission is made through a bot from somewhere else outside your site, it will not allow them to submit.

If you need to download the latest updated version, click here.

ABVFP will not prevent manual spamming your form, but i don't beleive that this is the case here.

[Jeremy]

Re: Form Being Spammed

Hey George,

Our form is being spammed as well (www.bwservices.ca/na_en_contact.php) and I am getting the same spam as the other fellow.

.. and I was just going to ask you if they people accually take the time to fill them in? .. or if it was a bot like you just mentioned ..

[navaldesign]

Re: Form Being Spammed

Hi Jeremy,

yes, i beleive that's a bot submission. You need ABVFP that will NOT allow bot submission. If you want, contact me. You can download the zip here