PHP style Anti-Spam
Discussion
One for the real tech-heads...
I have a PHP site, that allows users to comment, edit, post new items and a lot of other stuff.
The one thing that I can't seem to find a solution for, is anti-spam.
I use the obvious 'CAPTCHA' for signup and emailing etc, but lets say we perform an action such as commenting or a new forum post... Once the user has submitted their form for POST, the back end takes it an enters it. Now, if I hit refresh, it processes the POST request again.
Currently, I use a timestamp + 30, to make the users wait 30 seconds before being allowed to submit successfully, but I would like to be a bit more clever than that. I've looked around and can't seem to find any solutions.
One though, was to take timestamp - 100, and then plus 30 everytime they post, (so that multiple posts in a short time frame will cause the timestamp to be greater than time()) but there is a flaw, if someone posts once, then waits an hour, this timestamp will be timestamp-3600 or the like.
I've you've understood any of the above, your thoughts would be welcomed!
I have a PHP site, that allows users to comment, edit, post new items and a lot of other stuff.
The one thing that I can't seem to find a solution for, is anti-spam.
I use the obvious 'CAPTCHA' for signup and emailing etc, but lets say we perform an action such as commenting or a new forum post... Once the user has submitted their form for POST, the back end takes it an enters it. Now, if I hit refresh, it processes the POST request again.
Currently, I use a timestamp + 30, to make the users wait 30 seconds before being allowed to submit successfully, but I would like to be a bit more clever than that. I've looked around and can't seem to find any solutions.
One though, was to take timestamp - 100, and then plus 30 everytime they post, (so that multiple posts in a short time frame will cause the timestamp to be greater than time()) but there is a flaw, if someone posts once, then waits an hour, this timestamp will be timestamp-3600 or the like.
I've you've understood any of the above, your thoughts would be welcomed!
if all you're wanting to achieve is avoid someone pressing refresh, you could:
- Post the reply via AJAX where available. Use JavaScript to disable submit buttons etc.
- Use an redirect page (e.g. the form action is on a seperate page to the "thank you").
- Why not include the time within the form submission (easily done with Javascript onsubmit) - if the two are within a certain tollerance then fine...
Gassing Station | Computers, Gadgets & Stuff | Top of Page | What's New | My Stuff