Question

I am creating a comment form based on the jquery validation plugin (http://docs.jquery.com/Plugins/Validation). I know that javascript can easily be manipulated by hackers, so I was wondering how to validate via php to insure that the comment form does not generate a lot of spam emails?

The js is directly from the validation plugin. The html form is directly from the JS validation plugin page. The additional js is below:

  <script>
  $(document).ready(function(){
  $("#commentForm").submit(function(){
    if($("#commentForm").validate()){
        $.ajax({
            type: 'POST',
            url: 'process.php',
            data: $(this).serialize(),
            success: function(returnedData){
                alert(returnedData);
            }
        });
    }
    return false;
});
});
  </script>

<form class="cmxform" id="commentForm" method="POST" action="process.php">
   <label for="cname">Name</label>
   <input id="cname" name="name" size="25" class="required" minlength="2" />
   <label for="cemail">E-Mail</label>
   <input id="cemail" name="email" size="25"  class="required email" />
   <label for="curl">URL</label>
   <input id="curl" name="url" size="25"  class="url" value="" />
   <label for="ccomment">Your comment</label>
   <textarea id="ccomment" name="comment" cols="22"  class="required"></textarea>
<input class="submit" type="submit" value="Submit"/>

The php is pretty standard currently. Not sure how to integrate the validation with js and ajax:

<?php

$to      = '[e-mail]';
$subject = 'the subject';
$message = 'hello';
$headers = 'From: [e-mail]';

mail($to, $subject, $message, $headers);

print "Form submitted successfully: <br>Your name is <b>".$_POST['cname']."</b> and your email is <b>".$_POST['email']."</b><br>";
?>

Thanks for any help. Someone has commented that this is vague. To clarify:

I understand how to use php to validate email length, unnecessary characters, etc. I do not understand how the jquery validation plugin works via ajax. I need to know how to configure my php conditionals to properly validate the comment form to protect against spam.

Answer 1

Ok the way you do this is pretty straight forward.
So you have a submit function, but before you actually send a request to the .php file, you need to validate the input. Your code is pretty sound so far, but you need to start with the validate function. That could look something like this(in jQuery). Let’s say that your input fields have the following id: #input1,#input2,#input3,#input4.

    function validate()
{
    if($('#input1).val()=='' || $('#input2).val()==''|| $('#input3).val()=='' $('#input4).val()=='') return 0;
    else return 1;

}

This would be the most basic way to use validation. If you don’t want jQuery, you could replace $(‘#input1) with docoument.getElementById(the old fashioned way). If you also want to make it look nice for the user, you could validate each input field on blur!
For instance, let’s assume the user focuses on the first input field, #input1

$('#input1).focus(function(){change the background color,add a border, or anything you want just to let the users see which input they clicked/tabbed on.}).blur(function(){check if the input is valid and if it's not display a message or anything you want.});