Question

i have these forms:

https://www.mychabad.org/templates/articlecco.asp?aid=1188756&jewish=General-Contributions.htm&lang=en&site=chabaduc.org

https://www.mychabad.org/templates/articlecco.asp?AID=1189379

https://www.mychabad.org/templates/articlecco.asp?aid=1189287&jewish=Shabbat-Holiday-Sponsorships.htm&lang=en&site=chabaduc.org

and last night they were attacked by a bunch of submissions

1. is there anything simple i can with the code to avoid such attacks?
2. if not, should i be using a different form service?

Answer 1

CAPTCHA is the most well-known solution, but if you’re looking for something simple, I’ve found that this works quite well: set your form’s submit URL to blank (or something invalid) and introduce it via JavaScript. So far, I haven’t seen a bot that executes JavaScript to get past forms. This does mean that users need to have JavaScript enabled, but most do anyway.

Example:

<form id="myform" action="" onsubmit="return doSubmit();">
...
</form>

<script type="text/javascript">
function doSubmit() {
  // You can also do any validation here if required
  document.getElementById('myform').action = 'real_submit_url';
  return true;
}
</script>