如何将空白反垃圾邮件输入字段添加到我的form.php中

Question

I have a form that I am trying to add some steps that will minimize spam without forcing the end user to input some random number text series.

here's an example of my form code:

<form action="form.php" method="post">
<label for="Name" style="some style">Enter your name:</label>
<input type="text" name="name">
<label for="Email" style="some style">Your email address:</label>
<input type="text" name="email">
<label for="City" style="some style">City:</label>

<select id="some ID" name="city" value="PQS" >
<option value="" selected disabled>Choose A City</option>
<option value="City1">City1</option>
<option value="City2">City2</option>

<input type="submit" value="Sign Up Now" class="button" id="subscribe">
</form> 
<p id="error" style="some style">OOPS! Something went wrong. Please try again.</p>
<p id="success" style="some style">Success! We’ll contact you shortly</p>

---

My current form.php looks somewhat like this:

<?php

$emailmanager = 'me@myemail.com';
$name = $_POST['name'];
$visitor_email = $_POST['email'];
$city = $_POST['city'];

error_reporting(0);

$email = trim($_POST['email']);
$Ok = ereg("^([a-zA-Z0-9_\.-]+)@((\[[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.)|(([a-zA-Z0-9\-]+\.)+))    ([a-zA-Z]{2,4}|[0-9]{1,3})(\]?)$", $email);
if ($Ok) {
mail($emailmanager,'New Contact Request','You have a new contact request for homes in '.$_POST['city'].' from '.$_POST['name'].' ','From: '.$_POST['email'].' ');


if( !ereg("^[_a-z0-9-]+(\.[_a-z0-9-]+)*@[a-z0-9-]+(\.[a-z0-9-]+)*(\.[a-z]{2,3})$",$UNameFrm) )
{
    echo 1;
}

}

else 
{
    echo 0; 
}

What I am trying to incorporate is a blank field that can deter the spambots, and I found an awesome code to use but I would like to incorporate it into my code above. See below the code i found:

<?php 
// if the url field is empty 
if(isset($_POST['url']) && $_POST['url'] == ''){

 // put your email address here     
 $youremail = 'you@yoursite.com';

 // prepare a "pretty" version of the message
 $body = "This is the form that was just submitted:     
Name:  $_POST[name]
E-Mail: $_POST[email]
Message: $_POST[message]"; 

 // Use the submitters email if they supplied one     
 // (and it isn't trying to hack your form).     
 // Otherwise send from your email address.     

 if( $_POST['email'] && !preg_match( "/[\r\n]/", $_POST['email']) ) {
     $headers = "From: $_POST[email]";     
 } else {
     $headers = "From: $youremail"; 
 }

 // finally, send the message     
 mail($youremail, 'Contact Form', $body, $headers ); } // otherwise, let the spammer think that they got their message through ?>

This code i found requires me to create a class

.antispam { display:none;} 

...and add some html in my form

<label for="url" class="anti spam">Leave This Empty:</label>
<input type="text" name="url" />  

how do I incorporate these 2 together? There are some things that are obvious to me, like adding

$url = $_POST['url']; 

to my form.php on the next line following $city. My challenge is where to incorporate

// if the url field is empty 
if(isset($_POST['url']) && $_POST['url'] == '')

and

 if( $_POST['email'] && !preg_match( "/[\r\n]/", $_POST['email']) ) {
     $headers = "From: $_POST[email]";     
 } else {
     $headers = "From: $youremail"; 
 }

into my form.php without screwing up my form function entirely. Any help would be appreciated, and I hope I made my question clear

Answer 1

You should put the class on the input , not the label , since labels aren't sent to the server.

<input type="text" class="antispam" name="antispam" value="">

Browsers won't send inputs that have display: none; , so if you receive this input, it means it came from an automated spammer.

if (isset($_POST['antispam'])) {
    // Reject as spam
}

Answer 2

You generate a random token for each guest session (or even user's login or form page) and save in database. When printing forms, add one hidden input.

<input type="hidden" name="token" value="token_value_RANDOM1234567890">

When user submits form, then you check if given token is valid (or belongs to authenticated user, in login case). If belongs, then he's a valid user, else is a bot (not so simple as that). By the way, it complicates the process of spamming, do not block all ways of spamming. And you get an improvement on your website security.

Hope it helps.

Answer 3

I use this honeypot tactic all the time. The trick is to create a field on the form that will not be visible to humans with eyes, but will be seen by bots. I usually give it an attractive name like "url" like your example does.

<input class="honeypot" name="url" value="url" />

Then you use CSS to push it off the screen:

input.honeypot {
    position:absolute;
    left:-5000px;
}

That can go anywhere in your stylesheet, or in a <style> tag in your html, or right on the input

<input style="position:absolute; left:-5000px;" name="url" value="url" />

Then you need a test in the validation code which is the action PHP:

if (isset($_POST['url'] && 'url' != $_POST['url']) {
    header("location:/routing-error"); 
}

This gives the bot a 404 for the page "routing-error"