Blocking Spam With Javascript

Phil Tanny · 10-08-2011, 02:02 PM

Hi all,

Exper coder Will Bontrager shared this spam busting tip with me, and I thought you might find it useful.

---------------

One of the easiest form spam reduction techniques is to put a URL in the form's action tag that goes to a regular page instead of the form handling script - a real page, not a 404, so spammers don't get notified to manually investigate your code.

Somewhere below the form, JavaScript assigns the correct URL to the action tag.

The form tag needs an id value for the JavaScript to use. Example:

<form id="handle" action="/index.html"> ... </form>

<script type="text/javascript"> document.getElementById("handle").action = "/script.php"; </script>

Spammers' robots seldom parse JavaScript, so their automated submission never reaches the form handler specified by the JavaScript.

Instead, their spam goes poof at the URL hard coded into the form tag.

dave · 10-12-2011, 02:45 PM

This is good, but only a workaround. A lot of new automation tools interact with real web browsers directly, in this case it wouldn't work.

You are better off checking the data sent using the akismet api. You can get a free api key with a wordpress.com account, then get your coder to use one of the libraries here: Akismet development - libraries and plugins

Phil Tanny · 10-12-2011, 02:50 PM

Dave, thanks for adding your input, appreciate it. Yes, it's not my idea, and I make no claim it's the ultimate perfect solution. I just thought it was interesting, and might be useful to someone. Your solution is probably more comprehensive, but requires more skill?