Battling form spam

[Rick Altman]

At our website, www.BetterPresenting.com, we take book orders and host an annual conference. Our modest submission-form needs are met with your basic garden-variety form.cgi script (www.betterppt.com/form.zip). Meanwhile, we average about four to six form spam intrusions per day, so this is not an emergency, just an annoyance. In my hope to find a solution that uses our existing plumbing, I came up with the following scheme:

1. Spam bots indiscriminately fill out every field in a form and send it off.

2. If a field is not visible to a human, he or she would most likely not enter data into it.

3. I added a CSS rule into our external .css file called hiddenrow.

4. I applied this rule to the row of the table that holds the field in question.

(I also included a simple "do not enter data in this field" comment next to the field, in case someone is using an old browser or for whatever reason the CSS rule is not working.)

5. It should be a simple matter to include a test at the beginning of the send_mail subroutine that checks for contents in the hidden field. If it finds content, the subroutine aborts; if it does not find content, it continues.

I suspect that this would eliminate 95% of the form spam we now receive. The only problem is that I don't know how to code it! I tried the following:

sub send_email { 
if ($Form{'hiddenfield'} eq '') { 
[continue with send_email subroutine] 
} 
} 
 

but it did not work properly. I would be most grateful if some of the expters here could a) test my theory and my logic; and b) if they are sound, help me figure out the proper syntax for this seemingly-simple task.

Many thanks.
Rick A.

[numberwhun]

First, I would rather check for data, rather than no data. You could simply do:

sub send_email { 
if ($Form{'hiddenfield'}) { 
    exit;
}
 
***rest of send_email processing***
}
 

This way, if there is data it stops, if not, it skips over the if.

Second, you may want to consider implementing a Captcha interface into the form instead. Bots cannot see the image to enter the text. So, if the Captcha is empty, don't submit.

Regards,

Jeff

[Rick Altman]

Jeff, thank you very much for your reply. I have instituted your proposed change, but I just cannot get the form to cooperate. I have carefully added in the syntax above to the sub send_mail routine, but the form submits no matter what the status is of the hidden field.

If it helps, I have made my form.cgi file available at www.betterppt.com/form.zip.

[chorny]

form.cgi is written in old Perl style (but at least it uses CGI.pm).

form.cgi has several subs to send e-mail.

&send_email if ($send_email);
&send_confirmation_email if ($send_confirmation_email);

But send_confirmation_email is called after send_email, so it should not matter.

Is HTML form that user fills located in standalone file?

[Rick Altman]

Yes it is.

http://www.betterppt.com/book/order.htm