Question

I am building a comment form for a website. Eventually, it will be a popup jquery form utilizing ajax. I am trying to get the php together right now and want to make sure that I cover all of the bases to protect against spam.

There are four fields: email, name, url, and comment. This is what I have for the php so far:

$email = $_POST['email'];

if(!filter_var($email, FILTER_VALIDATE_EMAIL)){ 
    print "E-mail is correct";

    $to      = '[e-mail]';
    $subject = 'the subject';
    $message = 'hello';
    $headers = 'From: [e-mail]';

    mail($to, $subject, $message, $headers);

} else {
    print "E-mail is not correct";
}

Just checking to make sure that the user is using a proper email address. I am not utilizing a database so am not worried as much about SQL injection or other database related problems. I just want the form to be secure against spam-bots.

What are the other elements I should include in my php to protect against spam?

Answer 1

You can generally not decide if a message is spam or a desired text, so syntactic checks like the one you did for the email won’t work.

there are on the other hand some solutions out there that try to find certain properties that could identify a message as spam. you can for instance look into http://wordpress.org/extend/plugins/akismet

a common solution is to use a captcha. that is a picture containing some obfuscated text only a human can read. google provides a simple captcha system, if you want to try: http://www.google.com/recaptcha