Discover and share the best of the web!
Learn more about Digg by taking the tour.
Fighting Form Spam with CSS
modernbluedesign.com — Step by step guide using CSS to eliminate automated robots and spam fillers from getting through your forms.
- 1059 diggs
- digg it
- riverrunner, on 10/11/2007, -1/+30This has worked for me also - but I am reluctant to digg it cause the spammers will figure out a way around it if they realize too many people are using it!
- jbhannah, on 10/11/2007, -4/+1But then again, how many spammers are smart enough to look for something like that on digg?
- DruSam, on 10/11/2007, -4/+1A few, me included.
- jasg, on 10/11/2007, -0/+1u r scum
- DruSam, on 10/11/2007, -4/+1A few, me included.
- mraustin1337, on 10/11/2007, -0/+2Spammers are too lazy to figure out how css works and make their bots understand it. Not only that but you can do this in a lot of ways so if a bot figures out one, do another (perhaps javascript based) and confuse it more. Very very intelligent solution.
- HonoredMule, on 10/11/2007, -0/+1There's a lot of room for creativity with this approach, and until it doesn't work, we might as well make good use of it. Even if the method becomes ubiquitous (meaning it's working well, and helping a lot of people), spammers will still have to code uphill against many possible implementations. By the time their bots can intelligently scan the CSS and behave accordingly, we can all have moved on to javascripts deleting the dummy fields, or swapping labels, or ...
There's a lot of ways to totally confound even very advanced parsers while still making complete sense associatively to humans. Spammers could potentially have to do more work coding fixes for hundreds of websites than it would take to just post the spam by hand.
- jbhannah, on 10/11/2007, -4/+1But then again, how many spammers are smart enough to look for something like that on digg?
- HarryBauzonia, on 10/11/2007, -0/+5Thanks for posting this.
I've been looking for something like that. - DuctTape31, on 10/11/2007, -1/+5This looks interesting, i will have to see if i can use it to filter the spam on my photoblog. Anyone know if this will work with the posting in a pixelpost photoblog?
- greydiode, on 10/11/2007, -1/+6Would it help to set the tabindex to -1? Or would the browser skip the input field anyway since it's hidden?
- modernblue, on 10/11/2007, -1/+6It wouldn't actually make a difference. The tabindex doesn't include hidden elements. Good thought though.
- dotlizard, on 10/11/2007, -4/+1it's NOT a hidden element. it's invisible thru CSS -- the spambots aren't going to be fooled by a hidden field, in fact they most likely avoid it in order not to screw up (say, a post ID number) which might result in their spam not being displayed, heaven forbid.
you use CSS to hide a "TEXT" element -- that is what fools them. The bots do not read your CSS, so they see it like any other field. It's humans with browsers, who can't see it.
or you could of course RTFA, where this was explained. - dotlizard, on 10/11/2007, -2/+1yeah, i'm usually fine with being dugg down when i'm trying to be, you know, witty or something, but in this case -- excuse me? my reply is technically accurate and demonstrates some knowledge of the article and the concept -- which the things i am responding to (which are getting dugg up), do not. i'm not trying to be an *****, just pointing out facts.
whatever. i seriously would like to help inform people about this, i'm just a little disappointed that that is an unpopular sort of thing to do. - endyminion, on 10/11/2007, -0/+1dotlizard: I think people are failing to realize that there is an input tag type="hidden". CGI scripts use to store meta data for dynamically set data fields they want Javascript to muck with or whatever they deem it useful for.
People, he is right, it's an important distinction to be making, so don't dig him down. Invisible fields are vastly different from hidden fields from a coding (and by proxy spam bot) standpoint!
- mcm297, on 10/11/2007, -3/+6This fails for those who don't "browse happy." The best way to deal with spam comments is to do as digg does with the "are you human?" input. When in Rome, do as the Romans do...
- noahhoward, on 10/11/2007, -0/+2What exactly do you mean? I can't think how this would fail.
- mcm297, on 10/11/2007, -0/+2Technically this won't "fail", however for some users who browse using non-CSS compatible browsers, they'll be confused by seeing the extra "special" input element.
- JulioJuliopolis, on 10/11/2007, -0/+3A little bit of text in the division made invisible to most of us by CSS, could explain to those using browsers without CSS to leave the box empty. Actually with a short message making the box invisible wouldn't be strictly necessary.
- FiP0, on 10/11/2007, -1/+1If you're browsing on something other than a computer.
a PDA, a nintendo DS, an "audio" browser, etc, etc. - mcm297, on 10/11/2007, -1/+2Many people drop comments using their mobile phone's XHTML browsers... until this iPhone thingy comes out.
- dotlizard, on 10/11/2007, -0/+2yeah, and when i'm browsing on my PDA, being a human, i recognize the extraneous spambot-catcher fields, and i don't fill them in.
if you really need to dumb it down for PDA surfers, give it a really silly name, and hide some text with that same hiding CSS that 'splains what you're doing. But, most of them can figure it out on their own. - mcm297, on 10/11/2007, -0/+2≤label for="spam_trap">Are you a spammer?≤/label>
- SmileyChris, on 10/11/2007, -0/+3So what if people with CSS off/broken type "no"?
(reminds me of Homer causing Lisa to lose due to writing "ok" in the space marked "Do not write under this line") - dotlizard, on 10/11/2007, -0/+2well then, make the label less confusing. say, 'fill in this box if you are a spamming bot, but if you are a human please leave it blank", the label will show whether the css is broken or missing, and hopefully the user can work out that that means not to type in the box.
however i would recommend finding clever synonyms for 'spam', 'bot', etc, because bots trying to bypass this would look for those terms in proximity to the field.- capiCrimm, on 10/11/2007, -0/+1How about...
"change the text in this box if you want me to hunt you down and rape your mother infront of you"
or
"if you have thought about changing your gender, then having sex with a horse while a penguin films it. Please change the text in this box"
Now you prevent spam bots and sick perverts without css!
- capiCrimm, on 10/11/2007, -0/+1How about...
- SmileyChris, on 10/11/2007, -0/+3So what if people with CSS off/broken type "no"?
- boxxa, on 10/11/2007, -0/+4Very good idea for simple spam!
- coolspray, on 10/11/2007, -0/+6The spammers could pretty easily find if it has certain attributes (such as visibility hidden). Probably just move on to easier targets though.
- mcm297, on 10/11/2007, -0/+1That is if the styles were inline with the elements... it's much more difficult to search for hidden attributes in elements using the method that the author presented.
- FiP0, on 10/11/2007, -0/+5Even "type in this word" (always the same) is enough :
CAPTCHA effectiveness :
http://www.codinghorror.com/blog/archives/000712.html
"The comment form of my blog is protected by what I refer to as "naive CAPTCHA", where the CAPTCHA term is the same every single time. This has to be the most ineffective CAPTCHA of all time, and yet it stops 99.9% of comment spam. I can count on two hands the number of manually entered comment spams I've gotten since I implemented " - willemmulder, on 10/11/2007, -1/+1you could also create a parent-element with visibility or display to "none"... They won't find out too easy, I assume..
and @Fipo: maybe even something like: "type 1234 in reverse", which would make it a lot more difficult for machines to interpret. Even more if you split the sentence and put the parts in different DIV's... or maybe even hidden DIVs between with random text...
- lollercopters, on 10/11/2007, -4/+11I don't want to fight spam with CSS. I want to fight counter-terroists.
- ConservoHippie, on 10/11/2007, -2/+2CTU v CSS?
- j3one, on 10/11/2007, -0/+1nub FTL
- j3one, on 10/11/2007, -1/+2But they look so cute in their little blue outfits.. ah screw it, kill the hosties...
- ConservoHippie, on 10/11/2007, -2/+2CTU v CSS?
- matt9m5, on 10/11/2007, -5/+2Time to open up Coda. Bye Bye Spam.
- mileswj, on 10/11/2007, -8/+1www.duggmirror.com
- BigKoala, on 10/11/2007, -11/+1Whatever.
I prefer my own way of handling form spam: In order to get the form through you have to listen to a word in an automatically generated mp3 file and en type it into a field. For deaf people I have the option to send a text message over their mobile phone; they will receive a text code that they'll have to type in another field.- noahhoward, on 10/11/2007, -0/+8Bet the deaf people use your site all the time. That is too complicated, the whole point of this method is that you don't inconvenience the user at all but you stop spam. The user shouldn't have to prove they are a user the spammers should have to prove they aren't spamers.
- silly110671, on 10/11/2007, -0/+2"For deaf people I have the option to send a text message over their mobile phone"
I don't know many deaf people with mobile phones... but that's just me. - smackhero, on 10/11/2007, -0/+1wow, that is the dumbest, least practical way of dealing with spam. implementing a good captcha system got rid of 99.9% of the spam we were getting in our forums. and it doesn't annoy the ***** out of people.
- phantom42, on 10/11/2007, -0/+14i've been using this method for a few months now, and we've yet to get any spam. one suggestion though. instead of applying the class to the input box, create a div/span with the hidden class and give instructions to leave the box blank. this way, users with browsers that don't render css aren't left completely confused.
- modernblue, on 10/11/2007, -0/+1that's a good idea phantom... and solves some of the issues people were bringing up.
- kevsedg, on 10/11/2007, -7/+1http://www.diggmirror.com/
- kevsedg, on 10/11/2007, -1/+3http://www.duggmirror.com/ sorry
- j3one, on 10/11/2007, -0/+2http://www.duggmirror.com really sorry
- kevsedg, on 10/11/2007, -1/+3http://www.duggmirror.com/ sorry
- thephosphorbox, on 10/11/2007, -7/+4I just design all my forms in Flash and have them dump data into PHP scripts. No fields for spam bots to find, no submit button.. and once you understand how they work, making forms in Flash is just as easy (if not easier) than good ole HTML.
- phantom42, on 10/11/2007, -0/+9that works for some types of sites, but requiring flash doesn't work for sites which need to be 508 compliant.
- joco888, on 10/11/2007, -0/+0You should probably write your government and try to convince them to make that 508 thing more flash-friendly.
- LoudNoise, on 10/11/2007, -0/+6If I ever saw a flash form, I'd leave the site immediately.
Actually, I wold probably be confused as hell, seeing as how I use Flashblock. WHERE DOES THE DATA GO?!- joco888, on 10/11/2007, -0/+0Well, if you use flashblock you will have big problems seeing flash content, so you probably don't want to use that. Lets say you visited a flash-site that were giving out 1 million dollars to each visitor, using flashblock you wouldn't be able to see it - and you would loose 1 million dollar. That is just plain stupid!
- joco888, on 10/11/2007, -0/+0Well, if you use flashblock you will have big problems seeing flash content, so you probably don't want to use that. Lets say you visited a flash-site that were giving out 1 million dollars to each visitor, using flashblock you wouldn't be able to see it - and you would loose 1 million dollar. That is just plain stupid!
- rodrigomuniz, on 10/11/2007, -0/+7what about accessibility?
- joco888, on 10/11/2007, -1/+0what about it? flash is way more accessible than html.
- phantom42, on 10/11/2007, -0/+9that works for some types of sites, but requiring flash doesn't work for sites which need to be 508 compliant.
- cybe, on 10/11/2007, -0/+2More great resources:
http://nedbatchelder.com/text/stopbots.html
http://projecthoneypot.org/home.php- j3one, on 10/11/2007, -1/+1Did you ever think that maybe project honeypot is a honeypot for gathering developers info... tinfoil my man, tinfoil...
- thailand1972, on 10/11/2007, -2/+3Another way is to have a randomly named field for an email field (e.g. name of field = 349dAr4fvfdf). It prevents spam bots filling in the field appropriately (they don't know you need to enter an email here). Even if they "learn" it's an email field, when they return, it's called a different name. This works for me (have been doing this for over a year now).
- ekstasis16, on 10/11/2007, -0/+1What I've been seeing in my form results is bots filling in every field with a properly formatted email address, so as nice as this trick is, it wouldn't work in that case unless you're pattern matching other fields to look for @ symbols everywhere or something.
- thailand1972, on 10/11/2007, -0/+0It wouldn't take much in the form validation to trap such an obvious attempt to post spam (an "@" symbol in your full name field? This wouldn't pass my form validation code). I can only re-iterate - works for my websites.
- thailand1972, on 10/11/2007, -0/+0Hmmm - dugg down because this method works? Black is white, white is black - welcome to Digg.
- Alphabet, on 10/11/2007, -7/+1The css method will eventually be countered. A more reliable method is to just create the form using javascript. Instead of typing your form into the html/php page, put it into a seperate javascript file.
function generateForm() {
var formText = [add your form here];
document.write(formText);
//or do innerHTML = formText;
}
and then call the function on your webpage. This will stop all bots since bots will never be able to correctly parse javascript. It's also a lot less work. This, however, will not protect you against someone who tailors up a unique bot just for your site. But in those cases, the only way to stop them is by using a captcha.- Cl1mh4224rd, on 10/11/2007, -1/+5You pretty handily screw over people, like me, who have JavaScript disabled by default...
- willemmulder, on 10/11/2007, -1/+5so how did you put that comment here without javascript?
- phantom42, on 10/11/2007, -0/+6according to w3schools statistics, 6% of users browse with either no javascript support, or javascript disabled. by way of comparison, their statistics put mac users at 3.8% while mozilla (not FF) + opera + safari users total up to 4.4%. thats a large number of people who won't be able to use your form at all.
- mcm297, on 10/11/2007, -1/+2According to w3schools, one out of every four users browses with firefox. Those statistics are just from their user base, and aren't really representative of the population (their site is geared towards web designers for one.)
- phantom42, on 10/11/2007, -0/+1unfortunately, every statistic anyone could pull up is going to be skewed in some way. i would have preferred to get stats from thecounter.com, but for some reason its not coming up for me from my office.
honestly, the fact that 6% of web developers don't have javascript enabled should be discouraging enough - these are generally the tech savvy people we WANT commenting.
- phantom42, on 10/11/2007, -0/+1unfortunately, every statistic anyone could pull up is going to be skewed in some way. i would have preferred to get stats from thecounter.com, but for some reason its not coming up for me from my office.
- Alphabet, on 10/11/2007, -1/+1you people act like it's that hard to turn back on javascript...
- phantom42, on 10/11/2007, -0/+1not every browser HAS javascript.
- smackhero, on 10/11/2007, -0/+2i don't see how that would matter at all to the bot. it'll still see the forum elements and method in the page. it doesn't have to parse any javascript or even html, just use basic regexp pattern matching. you don't honestly think that spambots actually try to parse and render the page do you?
- Cl1mh4224rd, on 10/11/2007, -1/+5You pretty handily screw over people, like me, who have JavaScript disabled by default...
- eanbowman, on 10/11/2007, -2/+4You know what? This is damn brilliant.
For all of the lines of PHP I've coded just for this purpose - this is the quickest and likely most effective solution.
This combined with combing comments for malformed HTML and excessive links could be a really great solution.
Thanks for the, "Duh, you should have known!" - emehrkay, on 10/11/2007, -0/+3change visibility to display: none; so that the hidden input doesnt take up any space. maybe this trick would work for a while
- jriggall, on 10/11/2007, -0/+8I've had success with a different method which may not be possible for some of you to implement without server side scripting ability.
First, I assume that since the form is being filled out by a robot that it is going to be submitted rather quickly. When the form is first loaded I set the current time in a hidden form field. When the page is submitted I compare the new current time with the one from the hidden form field and if it took less than 3 seconds from page load to submit then I just disregard the message and don't follow through with the send email script.
This method has cut out nearly 95% of my form spam.- Otto, on 10/11/2007, -0/+2That is a good method, but I would also suggest that you filter obviously bad inputs: like anything older than a day, or anything in the future, etc. Comment spammers don't have to pull your form at the same time they submit it.
- arnoldrimmer, on 10/11/2007, -2/+0or try http://www.spampoison.com/
- NerdyNinja, on 10/11/2007, -0/+1Wow, that's really cool and useful!
- tpv2066, on 10/11/2007, -0/+4and now every spammer has updated their crawlers to match
- Cl1mh4224rd, on 10/11/2007, -0/+1This is an extremely old technique. Do you really think spammers take their cues based on what makes it to Digg's front page?
- lifewithryan, on 10/11/2007, -3/+1how well does this work for accessibility though? I mean using flash to create a form? A bit over kill don't you think? And what about your visually impaired users etc? Do screen readers read flash? (I honestly don't know) but I think the best solution (related to this method that is) is the invisible field with the instructions to leave it blank for those that don't render the page with CSS enabled. MUCH more accessible.
- CraigJ, on 10/11/2007, -0/+1did you read the article? HTML, PHP, CSS...
- abandonedhero, on 10/11/2007, -0/+2Did you read his comment? He was addressing the comment regarding using a flash form for commenting and the article. Good try.
- lifewithryan, on 02/05/2008, -0/+1Thanks for the back up man :) People use flash in all the wrong places these days...
- abandonedhero, on 10/11/2007, -0/+2Did you read his comment? He was addressing the comment regarding using a flash form for commenting and the article. Good try.
- CraigJ, on 10/11/2007, -0/+1did you read the article? HTML, PHP, CSS...
- Terminator1138, on 10/11/2007, -0/+1Dugg for ways to prevent spam....
- rebump, on 10/11/2007, -2/+1This solution will work very seldomly. As I asked the author on his site:
Aren’t most spam bots human configured/tuned? I think so. Thusly, a hidden form field may not be “configured” or “tuned” in to begin with if they are targetting your site. I know a bot I would write would still work on your site. Since your page is fairly unique (i.e. not discernable from footprint scanning or such) I would tune a spam bot to use it if I really wanted to. If your page was not unique (i.e. fit a footprint of say common forum software or such), then this approach would still not work since the mass of others lead me to discount your hidden form field (if I even noticed it). Nice thinking though.
I thought Digg users were more tech, no???- rebump, on 10/11/2007, -1/+1Digg me down but this is a crappy solution. A spammer, if they want to use your page for evil, will use it. Since it is a unique form, it will not have been found by any search result footprint scanning (other than the most generic). Even then, being such a generic find, it would need visual inspection to see what it does (i.e. create an account, e-mail the owner, etc.). Not too many bots I have seen just go willy nilly filling in forms. They are usually targetting fairly specific footprints such as a certain revision levels of forum software, a certain website user creation page, etc.
The guy's reduction in spam is based on how many total spam attempts? Seven? :) - modernblue, on 10/11/2007, -0/+1Most people probably don't have huge sites that would be targeted. That is why this solution would work for low-traffic sites. When I have done bigger sites for clients, we implemented CAPTCHA along with other ways as we tuned our form to fight the spammer. So, this is a good start for most people. As there site grew, their methods could improve and grow as well. We don't all have the same requirements as digg or espn. Why are you writing spam bots anyway?
- rebump, on 10/11/2007, -0/+1I would disagree with the benefit of such a system for the small sites you cite. Those site, being small, probably do not get much spam and if they do it is hand created anyway. I don't know of too many bots that go willy nilly filling in forms that are not targeted in some way (i.e. the bot knows what the form will do ahead of time).
This solution is like adding a feature to your car that helps clean camel hair off your windshield in the event you hit a camel...in America.
(so I such at analogies and such)- dutchthis, on 10/11/2007, -0/+1mmmmm... have to disagree there. I have quite a few "small sites" and this has worked for me pretty well. However, I would also recommend using PHP to search for html within the info people put into the form. Just as extra caution. That way, even if "live spammers" want to take the time to fill it out it their submissions won't count. You could even echo a statement back that says it was, but just don't email it. Has worked for me rebump.
- rebump, on 10/11/2007, -0/+0Always parse and clean your input - side benefit being spam filtering by default (since most spam involves embedded HTML for backlinks...which sucks if you are allowing links).
And "dutch"this...Dutch? Not Dutch-Dutch, but 50% Dutch. Dutch, FTW! ;)
- rebump, on 10/11/2007, -1/+0I didn't digg any of you guys down. Sheesh. Diggers are so negative lately.
- abandonedhero, on 10/11/2007, -0/+1We're not negative. We're just pessimistic. Speaking of negative, check out your comment's score.
- kiddailey, on 10/11/2007, -0/+1Why couldn't you, instead of telling the spammer to go away, just pretend like the form actually worked even with the extra field populated? How would the spammer know if it really was sent or not?
- rebump, on 10/11/2007, -1/+1Digg me down but this is a crappy solution. A spammer, if they want to use your page for evil, will use it. Since it is a unique form, it will not have been found by any search result footprint scanning (other than the most generic). Even then, being such a generic find, it would need visual inspection to see what it does (i.e. create an account, e-mail the owner, etc.). Not too many bots I have seen just go willy nilly filling in forms. They are usually targetting fairly specific footprints such as a certain revision levels of forum software, a certain website user creation page, etc.
- willemmulder, on 10/11/2007, -2/+1I did a trick that looks like this one, but with javascript... it takes a simple window.onload() that converts the value of a hidden input from a random value to "thisisnospam"...
But that required javascript to make it work... So, some unfortunate people wouldn't be able to put comments. In the end, this CSS-hack probably is better, but just for sharing... - ElectricSpeed, on 10/11/2007, -0/+3You can prevent form spam and "read books" with Carnegie Mellon University's reCAPTCHA (http://recaptcha.net/), and you can see a demo here: http://jamesthornton.com/james/contact.html
- jkramlich, on 10/11/2007, -1/+2For those who dislike CAPTCHA try HumanAuth ( http://www.gigoit.org/humanauth/ ). Basically you just click on pictures matching a theme to prove you are not a spam bot. It's open source and easily customizable.
- jjustin01, on 10/11/2007, -1/+0Why not evaluate the server making to post to your site. If it's not one you approve of, such as your own server, then block the post. Granted, this may not work if you're allowing other websites to post to your's, but if you don't, this is a quick one-liner of code.
- dutchthis, on 10/11/2007, -0/+0that doesn't always work. There are ways to mimic the header information posting to a site. Not going to get into it here though....
- ArmchairAthlete, on 10/11/2007, -1/+1Sounds good unless a spammer wants to spend time to work around it, which is of course possible.
I got some spam on my asp.net site but just came up with an easy way to ban any IP making a spam comment with a single click. Banned a couple IPs and haven't had any more spam in months.- Jellybob, on 10/11/2007, -0/+0That technique will work until someone spams you from a network of zombie machines, which will all be coming from different IP addresses, and probably hammering you at a crazy rate.
- Haplo, on 10/11/2007, -2/+1You fight spam not with filtering, but by reporting spammers. It's even not hard. Filtering will eventually get us where we are with email spam.
- arctic, on 10/11/2007, -4/+1Title is inaccurate. It involves programming with CSS, not only CSS and he gives no programming code examples.
- smackhero, on 10/11/2007, -0/+1yea, what server-side scripting language would you like him to teach you in a single blog entry?
it's a pretty simple concept to implement, and any competent developer should be able to whip up the code in 15 minutes or less. there's no point for him to provide the example code considering his target audience, which clearly doesn't include you. - CraigJ, on 10/11/2007, -0/+1This kinda looks like a code example to me? Did you actually read the article?
PHP example code:
$process = $_POST['process'];
$spam = $_POST['info'];
$name = $_POST['name'];
$email = $_POST['email'];
$comment = $_POST['comment'];
if ($process == "yes") {
if ($spam != "") {
echo "Stupid Spammer";
} else {
echo "No Spam. Process Script.";
// put the info here to send the email or whatever
}
} else { echo "What do you think you are doing?"; }
- smackhero, on 10/11/2007, -0/+1yea, what server-side scripting language would you like him to teach you in a single blog entry?
- daok, on 10/11/2007, -0/+1So easy to by pass, you just need to change your bot to go in the .css file and check if it's a visible field or not.. USEless in about humm few weeks.
- aboyd, on 10/11/2007, -0/+3Not 100% useless, because of variation. Someone wraps the element in a DIV, and sets THAT to hidden. So now the spam script needs to go through the entire hierarchy of the page, to see if any parent's visibility is hidden. Then, you can also use display: none. So now the spam script needs to check for that. Then, you can do it in JavaScript, so now the spam script needs to parse JavaScript too. Then, you can do other "prove you're human" things, such as a field that is 2 + 2 = _____ (fill in the blank). And you can vary that. And so on. There are a million little variations that you can do, and the spammers will have hell trying to catch what every individual on Earth is doing. The idea is simple: customize the trick a little bit to your site, and the spammers have a higher bar to get over not just for you but for everyone else that customized it differently.
- dutchthis, on 10/11/2007, -0/+1I am going to have to agree with aboyd on that one. its all about the hurdles...this is one of them
- miramardesign, on 10/11/2007, -0/+0thailand, good idea but how do you setup your php/or asp script to handle said random var?? I guess you would have to pass it in another var or store it to a cookie or session etc?? Or maybe use an array of post values .... source code is always welcome :)
- lilxvietxboi, on 10/11/2007, -0/+1It's called 'Negative Captcha' and is well documented here: http://www.nedbatchelder.com/text/stopbots.html
It actually works pretty good. At least for UCIrvine Network&Academic Computing Services. - gauthierm, on 10/11/2007, -0/+1Unless you are using a strong Turing test (ie a CAPTCHA) anyone who wants to automate form submission on your blog will find a way to do it. Obfuscating your form elements is bad for accessibility and is not difficult to detect, or to work-around.
- addicted68098, on 10/11/2007, -1/+1And how would that work in a text browser!
- poked, on 10/11/2007, -0/+1great advice there, will help us where I work cheers
- btgarner, on 10/11/2007, -0/+2The method that I have found effective is to simply look for "http://" in the comment, and if it finds it, flag it as inappropriate and tell the person to try again. Since I did this, I have not received a single spam comment on any of the 5 web comment forms that I have up on various sites.
- smackhero, on 10/11/2007, -0/+1yea, that's a very simple solution that i think would work for most forms. often users have no reason to post URLs. i like this solution too though since CAPTCHAs are sometimes annoying. it's not as fool-proof as CAPTCHA, but it'll work in most cases.
however, i first read about this idea probably a year and a half ago. i imagine as it gets more popular spammers will start taking it into account. all that it would require is for the bot to parse the CSS file and detect hidden elements. if a browser can do it, a spambot can as well. CAPTCHAs will always be superior in that respect.
- smackhero, on 10/11/2007, -0/+1yea, that's a very simple solution that i think would work for most forms. often users have no reason to post URLs. i like this solution too though since CAPTCHAs are sometimes annoying. it's not as fool-proof as CAPTCHA, but it'll work in most cases.
- hxseven, on 10/11/2007, -0/+0The technique is also know as Negative Captcha...
http://digg.com/programming/Negative_Captcha - yogastore, on 06/27/2008, -0/+0http://astore.amazon.com/baby.dry.diapers-20
http://astore.amazon.com/huggies.baby.diapers-20
http://astore.amazon.com/nike.heart.rate.monitor.w ...
http://astore.amazon.com/polar.heart.rate.monitor. ...
http://astore.amazon.com/digital.bathroom.scale-20
http://astore.amazon.com/digital.food.scale-20
http://astore.amazon.com/kitchen.trash.can-20
http://astore.amazon.com/outdoor.trash.can-20
http://astore.amazon.com/digital.pedometer-20
http://astore.amazon.com/omron.digital.pedometer-2 ...
Browsing Digg on your phone just got easier with our enhancements to the