Question

I am writing a phonegap application which I want to send ajax request and register users
with some parameters for ex: full name,email,password.

What would be the most secure way to build my PHP script to prevent other users from
flooding my DB with register requests?

Answer 1

There are some standard methods:

• Captcha
• Add a hidden or invisible field to the form, and if any data is in it, disallow registration.
  Hidden will only catch stupid robots, as they can usually tell that that’s what it is, but invisible is trickier if you do it with CSS and/or Javascript. Variations on this theme are also good, such as having a field with a timestamp in it, then comparing it to now (and denying if it’s too old/from the future), or using magic values in some manner.
• Send them an email, if it bounces, disallow registration.
• Check the referral URL through $_SERVER['HTTP_REFERER']. If your registration page isn’t on your homepage, make it so they have to come from somewhere on your site.
• Use non-dictionary words for element labels. Although this can make debugging more of a pain, it prevents bots from guessing the type of data that would be valid in the field.