Search code examples
phpspam-preventionddos

Using random name fields for input to fight spambots

I'm considering using random input names for registration form. It would be done this way:

  1. User requests register form site.
  2. Create random names for input fields and save them to user's session.
  3. Render form and display it to the user.

I just wonder if that method gives me anything. If session driver is a cookie - it's encrypted and secured in the best possible way using third party library which I consider as save enough. If user don't except cookies I can refuse registration.
To remove cookies as potential security risk I can store sessions in database. This seems more secure but also might overload the server(?).
My question is quite simple. Is there any sense to implement such feature?

Solution

  • The standard approach is to have a hidden text field. That is a field with type=text, but with CSS rules applied to it so that it's invisible.

    markup: 

    <input type="text" name="put_some_innocuous_name_here" class="some_innocuous_css_class_name_here" value="" />

    CSS: 

    input.some_innocuous_css_class_name_here {
    display: none;
}

    PHP:

    if ((isset ($_POST ['put_some_innocuous_name_here']))
&& ($_POST ['put_some_innocuous_name_here'] != ''))
{
    throw new Exception ('Suspected bot!');
}

    The way this works is quite simple. A normal user will never see your hidden text field because CSS rules will keep it hidden. therefore a real user will never fill it out.

    However, most spambots aren't aware of CSS. They just parse the form markup and they see a text field that appears to need filling out. So they fill the field out with some random data. Because a form field that should never be seen by a normal user has been filled out, this means you're probably dealing with a bot.

    Don't use input type=hidden for this, because most spambots are smart enough to notice them and ignore them.