So, that's it? There's no way to stop the gits!

Sic

Sic

Sic

Soldato
Joined
9 Nov 2004
Posts
15,365
Location
SO16
i think i must've tried everything to stop my blog getting spammed.

when i first wrote it, it didnt have some form of CAPTCHA...so i wrote a very primitive form, which could probably do with an update...but it seemed to work for like 2 days.

i was then putting up with getting about 2 (what i can only assume were) manually submitted pieces of blog spam a day, just removing them as they were added.

then last week, enough was enough. i noticed all the spammers were either advertising tramadol, phentermine or scooters (wtf!!) so i decided to write a little something so i could ban certain words in my comments. i knew this wasnt going to stop it altogether, but it didnt even make a difference, even slightly (maybe it might when i put up a bigger list of banned words).

after that, i thought "maybe these are all coming from the same ip", i mean they were coming from the same email address...so i asked my host and he confirmed that there was an amount of usage for my comments posting file from this IP address. so i wrote something else to block ip addresses (ugh). so just as i block that ip address, i get submissions from 4 other ip addresses in one night. now i KNOW i'm not going to be able to block all ip addresses that would cause me trouble! although i might be able to thin them out somewhat

is there anything i can do to lessen these? as the blog has grown with age/size, it's getting more hits (god knows why) and more spam. have i missed anything blindingly obvious that i can do, or do i just have to put up and shut up?
 
Couldn't you just add submitted comments to a queue and manually validate them before they are displayed? Not the most technical solution but probably the simplest.
 
Beansprout said:
They're possibly automating passing the CAPTCHA - try making it less easily legible.
Click to expand...

i can barely read it sometimes :( i might redo the whole image now as i'm a little better with imagecreatefromgif

Adz - the problem is the moderation full stop. i dont really want to have to do any and that'd involve doing more.
 
Assuming it's robots doing this:

Include some Javascript in the process when a user submits a comment. E.g. make it so when the user clicks "Submit" it runs some Javascript code that _then_ performs the actual submission in a different way.
 
NathanE said:
Assuming it's robots doing this:

Include some Javascript in the process when a user submits a comment. E.g. make it so when the user clicks "Submit" it runs some Javascript code that _then_ performs the actual submission in a different way.
Click to expand...

could you be a little less vague...i dont really know what you're talking about
 
I think he's suggesting that you have the form submit to a 'dummy' location then use javascript to take the details entered when the form is submitted and submit them to the 'real' location. The automated robots parse the form, pick out the fields and submit to the action="..." which will obviously achieve nothing.

Are you sure it's automated though, that's the thing. If not, it will have no affect. In fact, if it's not automated, there's very little you can do :(.
 
this generates my image

Code: 
<?php
session_start();
$_SESSION['random'] = $random;
//generate random 6 digit number
$random = rand(100000, 999999);

$im = imagecreatefromjpeg("img/random.jpg");

$textcolor = imagecolorallocate($im, 255, 255, 255);

imagestring($im, 3, 75, 3, "$random", $textcolor);

header("Content-type: image/jpeg");
imagejpeg($im);
?>

this is cut from my post comment file

Code: 
$random = intval($_SESSION['random']);

$verify = htmlentities(intval($_POST['verify']));

   if (eregi("\r",$verify) || eregi("\n",$verify)){

     die("Why ?? :(");

if ($name == "" || $email == "" || $comment == "" || $verify != $random ){

echo "there's been a mistake";

it doesnt allow you to post if there's nothing there or if the code's wrong, but i don't know how they'd read it/bypass it. the code isnt printed anywhere but the image
 
A few things..

You were assigning $random to $_SESSION['random'] before you had generated the number - this is probably your loophole.. the first instance of the captcha for that session has no value! There for the user doesn't need to submit a verification code and the captcha will pass!

Code: 
<?php
session_start();

//generate random 6 digit number
$random = rand(100000, 999999);
$_SESSION['random'] = $random;

$im = imagecreatefromjpeg("img/random.jpg");

$textcolor = imagecolorallocate($im, 255, 255, 255);

imagestring($im, 3, 75, 3, "$random", $textcolor);

header("Content-type: image/jpeg");
imagejpeg($im);
?>

Next up, and less importantly, your validation is somewhat over done. If you have intval()'d a value, there is no need to check for newline/carriage return char's - int's don't have those :p

You can cut down your if's by using in_array(), and I have made the verification a little tighter, but again that's more personal preference than a necessity:

Code: 
<?php

if (in_array('', array($_POST['name'], $_POST['email'], $_POST['comment']))) {
    //failed validation..
}

if (intval($_POST['verify']) !== intval($_SESSION['random'])) {
    //failed CAPTCHA
}

?>
 
You must log in or register to reply here.
Back
Top Bottom