What CAPTCHA to use?

G

GJSNeptune

[H]F Junkie
Joined
Mar 31, 2004
Messages
12,372
It's sad this practice has to exist, but, alas, I've Googled endlessly (until now) for a suitable solution. If I come across something promising, it costs money, or I'm not sure if it's secure, or it's for a platform I don't use, like ColdFusion, etc.

I deal primarily with PHP, but I'm not sure if 1&1 has the necessary libraries. I tried a couple CAPTCHA solutions but the images never displayed, so I'm not sure if it's me or 1&1. Naturally I want it to be as unobtrusive for the user as possible, but I'm willing to sacrifice letting some spam get through as long as the bot doesn't hijack my form handler and manage to send the spam to millions compliments of me.

So, I need something relatively simple and easy to implement, while being reasonably secure. Even a general direction to search in would be good.
 
unhappy_mage posted this one a while ago and I thought it looked interesting, have not tried it myself though since I don't have a domain name to register it with. http://recaptcha.net/
 
Ah, yeah, I came across it. It's cumbersome. It's like a big applet for it. It looks promising, but I don't want something so blatant. Right now I just want some protection for a feedback form that emails me.
 
There is a hack for vBulletin that is said to be better than straight CAPTCHA. You ask a question that only a human could answer and has to enter it manually. For example, you could ask "What is the last name of the president of the United States?" They have to type in "bush" to proceed, which weeds out the bots that have cracked various CAPTCHAs. And hey, if they don't know the answer, they're probably too stupid for you to want to deal with them anyway. :eek:

I imagine you can find a general script somewhere that accomplishes the same thing. :)
 
Other than that my only experience is a ghetto 57 line long php captcha I made. It md5's 5 random digits and stores them in the session to compare against. Let me know if you want it, you're free to modify if you'd like as well.

Lethal's recommendation wouldn't be a bad way to go either.
 
what i did was create a "fake" email form field that I then set as hidden using CSS
Code: 
.fake {dispaly: none;}
.
.
<form....>
<p class="fake">
Leave blank if you're a real person<input name="email" type="text"...../>
</p>
<input name="real_email" type="text"...../>
.
.
</form>
since the the form is inside the hidden paragraph, the only way it would be filled in is if a bot auto filled the field, notice i named it "email" for those bots that look specifically for a field with that name. I used a paragraph so that I could tell those who might have styles turned off not to fill in that field.

on the server-side, i simply discard any posts that have the hidden field filled out.

it's worked like a charm for me. I was getting at least 5 spam messages a day, since i implemented this i haven't received a single spam message.
 
maw said:
what i did was create a "fake" email form field that I then set as hidden using CSS
Code: 
.fake {dispaly: none;}
.
.
<form....>
<p class="fake">
Leave blank if you're a real person<input name="email" type="text"...../>
</p>
<input name="real_email" type="text"...../>
.
.
</form>
since the the form is inside the hidden paragraph, the only way it would be filled in is if a bot auto filled the field, notice i named it "email" for those bots that look specifically for a field with that name. I used a paragraph so that I could tell those who might have styles turned off not to fill in that field.

on the server-side, i simply discard any posts that have the hidden field filled out.

it's worked like a charm for me. I was getting at least 5 spam messages a day, since i implemented this i haven't received a single spam message.
Click to expand...

Wow, that sounds like a great idea. I'll definitely tinker with it tonight.
 
I found one for Mediawiki that asked simple math questions, which was kinda cool. (Automated spam dropped to 0, direct attacks on the other hand ><). You could probably hack it up to output the math question as an image for added security.
 
Do I need to worry about the text fields? Are there any malicious things even a human can do with them?

While testing my feedback form, I sent myself a message containing a contraction, and the email resulted with I\'m. What can I do to prevent parsing like that?
 
GJSNeptune said:
Do I need to worry about the text fields? Are there any malicious things even a human can do with them?

While testing my feedback form, I sent myself a message containing a contraction, and the email resulted with I\'m. What can I do to prevent parsing like that?
Click to expand...

You need to be very aware of what people can send through text fields, people can easily hijack your forms if you aren't watching just by doing some tricks by escaping out of the field and adding their own emails and such.

http://framework.zend.com/manual/en/zend.mail.html

Thats a good secure mailer program.
 
jmackay said:
You need to be very aware of what people can send through text fields, people can easily hijack your forms if you aren't watching just by doing some tricks by escaping out of the field and adding their own emails and such.

http://framework.zend.com/manual/en/zend.mail.html

Thats a good secure mailer program.
Click to expand...

i like using the PHP Filter functions myself. Here are some examples of its use
Code: 
//check if email is in a valid format
$email = filter_var($email,FILTER_VALIDATE_EMAIL);
 //sanitize a string (remove potentially dangerous text like <script>, etc..)
$name = filter_var($name,FILTER_SANITIZE_STRING,FILTER_FLAG_STRIP_LOW);
 
How's this look? Anything I should add? Which filter will leave single quotations alone?

Code: 
$name = filter_var($name,FILTER_SANITIZE_STRING,FILTER_FLAG_STRIP_LOW);
$email = filter_var($email,FILTER_VALIDATE_EMAIL);
$message = filter_Var($message,FILTER_SANITIZE_STRING,FILTER_FLAG_STRIP_LOW);


Seems filter_var is only available in PHP 5.2 or higher, and I know 1&1 is using 4.something.
 
GJSNeptune said:
Seems filter_var is only available in PHP 5.2 or higher, and I know 1&1 is using 4.something.
Click to expand...

i use 1&1 and they do support PHP5. Here's how to make sure it's enabled

..."By default Apache uses PHP 4 for .php extension. If you don't want to rename all your
scripts to .php5 you can do the following:
Create a .htaccess file and place the following line AddType x-mapp-php5 .php in it.

This will tell Apache to use PHP 5 instead of PHP 4 for the extension .php in the
directory the .htaccess is placed and all sub-directories under it...."


Edit: Oh, and this should help tremendously in understanding the PHP Filter functions..
 
Thanks! Filters seem to be working. Are you also using the 1&1 Home Package? It seems pretty slow for me. Can't really ask much out of a pretty cheap shared hosting plan.
 
Lethal said:
There is a hack for vBulletin that is said to be better than straight CAPTCHA. You ask a question that only a human could answer and has to enter it manually. For example, you could ask "What is the last name of the president of the United States?" They have to type in "bush" to proceed, which weeds out the bots that have cracked various CAPTCHAs. And hey, if they don't know the answer, they're probably too stupid for you to want to deal with them anyway. :eek:

I imagine you can find a general script somewhere that accomplishes the same thing. :)
Click to expand...

It would be easy to write an AI to answer questions like that.
 
You must log in or register to reply here.
Back
Top