Question

What is the best solution to “form spoofing” besides filtering the inputs?

I understand the followings:

1. Referrer can be spoofed

2. Telnet can be used to fool the server

3. Client side filtering can be bypassed

4. i understand that i should avoid GET

5. I can use Captcha

How can i prevent somebody to post to my form processing scripts from anywhere?

Answer 1

If someone can manually post a form, they can do it automatically too. There’s no way to stop that besides moderation. You can make it harder by using captcha’s. But personally I hate captcha’s, because they are just a solution made up by lazy moderators to make the users solve their problems.