检查表格的安全性。

Question

My account was suspended because of SPAM several times and my host provider told me to check my website security. May be my forms are not secured enough. Do you think that this form can be used to send spam?

Here is my code:

<script type="text/javascript">
$(document).ready(function () {
    $('#form').ajaxForm({
        beforeSubmit: validate
    });

    function validate(formData, jqForm, options) {
        var name = $('input[name=name]').fieldValue();
        var email = $('input[name=email]').fieldValue();
        var company = $('input[name=company]').fieldValue();
        var location = $('input[name=location]').fieldValue();
        var phone = $('input[name=phone]').fieldValue();
        var message = $('textarea[name=message]').fieldValue();

        if (!name[0]) {
            alert('Please enter your name');
            return false;
        }
        if (!company[0]) {
            alert('Please enter the name of your organization');
            return false;
        }
        if (!email[0]) {
            alert('Please enter your e-mail address');
            return false;
        }
        if (!phone[0]) {
            alert('Please enter your phone number');
            return false;
        }
        if (!location[0]) {
            alert('Please enter your location');
            return false;
        }
        if (!message[0]) {
            alert('Please enter your message');
            return false;
        }

        else {

        $("#form").fadeOut(1000, function () {
            $(this).html("<img src='note.png' style='position: relative;margin: 0 auto;width: 500px;left: 20px;top: 30px;'/>").fadeIn(2000);
        });

        var message = $('textarea[name=message]').val('');
        var name = $('input[name=name]').val('');
        var email = $('input[name=email]').val('');
        var phone = $('input[name=phone]').val('');
        var company = $('input[name=company]').val('');
        var location = $('input[name=location]').val('');

            } 
    }

});

</script>

html:

<form id="form" method="post" name="form" action="send.php">

<input id="name" type="text" name="name"/>

<input id="company" type="text" name="company"/>

<input id="email" type="text" name="email"/>

<input id="phone" type="text" name="phone"/>

<input id="location" type="text" name="location"/>

<textarea name="message" id="message" rows="10"></textarea>

<input class="submit" type="submit" value="send" name="submit"></input>

</form>

php:

<?php
        if($_POST){
                $email = $_POST['email'];
                $name = $_POST ['name'];
                $company = $_POST ['company'];
                $phone = $_POST ['phone'];
                $location = $_POST ['location'];
                $message = $_POST ['message'];

                // response hash
                $ajaxresponse = array('type'=>'', 'message'=>'');

                try {
                        // do some sort of data validations, very simple example below
                        $all_fields = array('name', 'email', 'message');
                        filter_var($email, FILTER_VALIDATE_EMAIL);

                        foreach($all_fields as $field){
                                if(empty($_POST[$field])){
                                        throw new Exception('Required field "'.ucfirst($field).'" missing input.');
                                }
                        }

                        // ok, if field validations are ok
                        // now Send Email, ect.

                        // let's assume everything is ok, setup successful response
                        $subject = "Someone has contacted you";
                        //get todays date
                        $todayis = date("l, F j, Y, g:i a") ;

                        $message = " $todayis \n
                        Attention: \n\n
                        Please see the message below: \n\n
                        Email Address: $email \n\n
                        Organization: $company \n\n
                        Phone: $phone \n\n
                        Location: $location \n\n
                        Name: $name \n\n
                        Message: $message \n\n

                        ";

                        $from = "From: $email\r\n";


                        //put your email address here
                        mail("...@yahoo.com", $subject, $message, $from);

                        //prep json response
                        $ajaxresponse['type'] = 'success';
                        $ajaxresponse['message'] = 'Thank You! Will be in touch soon';  
                } catch(Exception $e){
                        $ajaxresponse['type'] = 'error';
                        $ajaxresponse['message'] = $e->getMessage();
                }
                // now we are ready to turn this hash into JSON
                print json_encode($ajaxresponse);
                exit;
        }
?>

Many thanks!

Answer 1

1. I have a simple approach to stopping spammers which is 100% effective, at least in my experience, and avoids the use of reCAPTCHA and similar approaches. I went from close to 100 spams per day on one of my sites' html forms to zero for the last 5 years once I implemented this approach.

2. another option is what I did is to use a hide field and put the time stamp on it and then compare to the time stamp on the PHP side, if it was faster than 15 seconds (depends on how big or small is your forms) that was a bot...

Answer 2

Your form would actually be not safe against bots, because you dont got any captcha or something.

2 Options for you:

1. Captcha

Captcha -> you got something to fill in -> you probably know this!:)

https://www.google.com/recaptcha

1. Honeypot

Honeypot means, you are adding hidden fields in your form. And if those hidden fields have changed - you know that a BOT has entered content in your form. Aswell, this is better than Captchas, because your User doesnt has to fill in a Captcha

I would prefer Honeypot, because I don't like forms, where i have to fill in a Captcha once or even twice, when I failed or the captcha wasnt readable.

http://haacked.com/archive/2007/09/11/honeypot-captcha.aspx/

Answer 3

Taking clue from the suggestions above, I am just putting a ready code for you to use.

HTML

<form id="form" method="post" name="form" action="send.php">

<input id="name" type="text" name="name"/>

<input id="company" type="text" name="company"/>

<input id="email" type="text" name="email"/>

<input id="checkbot" type="hidden" name="timestamp" value="" />

<input id="phone" type="text" name="phone"/>

<input id="location" type="text" name="location"/>

<textarea name="message" id="message" rows="10"></textarea>

<input class="submit" type="submit" value="send" name="submit"></input>

</form>

Javascript

<script type="text/javascript">
$(document).ready(function () {
    /*Set current time on the hidden field.*/
    $('#checkbot').val($.now());

    $('#form').ajaxForm({
        beforeSubmit: validate
    });

    function validate(formData, jqForm, options) {
        var name = $('input[name=name]').fieldValue();
        var email = $('input[name=email]').fieldValue();
        var company = $('input[name=company]').fieldValue();
        var location = $('input[name=location]').fieldValue();
        var phone = $('input[name=phone]').fieldValue();
        var message = $('textarea[name=message]').fieldValue();

        if (!name[0]) {
            alert('Please enter your name');
            return false;
        }
        if (!company[0]) {
            alert('Please enter the name of your organization');
            return false;
        }
        if (!email[0]) {
            alert('Please enter your e-mail address');
            return false;
        }
        if (!phone[0]) {
            alert('Please enter your phone number');
            return false;
        }
        if (!location[0]) {
            alert('Please enter your location');
            return false;
        }
        if (!message[0]) {
            alert('Please enter your message');
            return false;
        }

        else {

        $("#form").fadeOut(1000, function () {
            $(this).html("<img src='note.png' style='position: relative;margin: 0 auto;width: 500px;left: 20px;top: 30px;'/>").fadeIn(2000);
        });

        var message = $('textarea[name=message]').val('');
        var name = $('input[name=name]').val('');
        var email = $('input[name=email]').val('');
        var phone = $('input[name=phone]').val('');
        var company = $('input[name=company]').val('');
        var location = $('input[name=location]').val('');

            } 
    }

});

</script>

PHP

<?php
        if($_POST){
                $email = $_POST['email'];
                $name = $_POST ['name'];
                $company = $_POST ['company'];
                $phone = $_POST ['phone'];
                $location = $_POST ['location'];
                $message = $_POST ['message'];
                $checkbot = $_POST['timestamp'];
                $time_diff = time() - $checkbot;

                //If Time difference is less than 15 sec it's a bot
                if($time_diff < 15){
                exit;
                }


                // response hash
                $ajaxresponse = array('type'=>'', 'message'=>'');

                try {
                        // do some sort of data validations, very simple example below
                        $all_fields = array('name', 'email', 'message');
                        filter_var($email, FILTER_VALIDATE_EMAIL);

                        foreach($all_fields as $field){
                                if(empty($_POST[$field])){
                                        throw new Exception('Required field "'.ucfirst($field).'" missing input.');
                                }
                        }

                        // ok, if field validations are ok
                        // now Send Email, ect.

                        // let's assume everything is ok, setup successful response
                        $subject = "Someone has contacted you";
                        //get todays date
                        $todayis = date("l, F j, Y, g:i a") ;

                        $message = " $todayis \n
                        Attention: \n\n
                        Please see the message below: \n\n
                        Email Address: $email \n\n
                        Organization: $company \n\n
                        Phone: $phone \n\n
                        Location: $location \n\n
                        Name: $name \n\n
                        Message: $message \n\n

                        ";

                        $from = "From: $email\r\n";


                        //put your email address here
                        mail("...@yahoo.com", $subject, $message, $from);

                        //prep json response
                        $ajaxresponse['type'] = 'success';
                        $ajaxresponse['message'] = 'Thank You! Will be in touch soon';  
                } catch(Exception $e){
                        $ajaxresponse['type'] = 'error';
                        $ajaxresponse['message'] = $e->getMessage();
                }
                // now we are ready to turn this hash into JSON
                print json_encode($ajaxresponse);
                exit;
        }
?>

Answer 4

In theory it can be used to send spam, because there are only checks if fields have values and as long the fields have a value, it does not care whether the input was human or a bot. You could improve the security by adding captcha codes ( http://www.captcha.net/ ), to validate if an individual filling in your form is a human.

Answer 5

Try using this Spam Checker . Useful program written in Java which looks up for spam IP Addresses using DNS lookups. Hope so it helps.