you place the code snippet in the php script that is the action for the form, near the very top, so it is tested before the rest of your action script runs and processes the data, and exits at that point.

Many scripts use a foreach($_POST as $value) loop to check for blank fields in the data sent, or for characters likely to be used by a hacker (; — { and similar, see SQL Injection examples), so you’d have to have a little bit of code that tested each $value and if it was your hidden field, skip the check.

An approach of avoiding HTML form spam is using CSS. Non-human spammers usually fills out every input field in a form and submit it, and to overcome this kind of spam you must be able to differ between real human form submits and non-human spam. A tech…

// check if man or machine
if ($_POST['human'] == “”){
echo “Bad doggy. Sit bobo. Sit.”;
exit;}

in the form? Do you place it right after the “from action”?

I think it would be difficult very difficult for a bot to detect that another div that is positioned in front of the dummy input field.

I don’t think screen readers read the DOM tree, at all. They read the screen, literally. For example, Opera. If you hide an element with CSS, the screen reader doesn’t see it. Why should it, really?

I suspect this method is perfectly fine for screen readers, but I haven’t tested it.

#human {
top: -100px;
left: -100px;
}

Hier ist die Idee in jedem Formular ein verstecktes Feld einzufügen, welches ein Spambot ausfüllen würde, ein Mensch allerdings nicht, da er dieses nicht sieht….

When I implemented it I first tried the complete snippet that he gave and immediately got an syntax error generated by the server.

Ultimately, I added only the Post check for the “human ” field, but still had a syntax error generated. I ran it by an associate of mine, David Lincer, and he discovered that there was code missing. In the ($_POST['human'] “”) argument it was missing “==”.

THE ORIGINAL CODE SNIPPET:

THE CORRECTED CODE:

In addition, I changed the relevent action to redirect to my thank you page so that any bot would think that it was successful and not bother to try another attack tactic. My final code looks something like this…

Create say 4 human fields

Add the CSS code to your style sheet
#human {
visibility:hidden;
display:none;
}

Then in your form to email script decide which one you would check for needing to contain no values.

// check if man or machine
if ($_POST['human3'] “”){ //you choose human1 – 4
echo “Bad doggy. Sit bobo. Sit.”;
exit;}

Could even add a randomizer for the four fields to make it even more random.

// This line prevents values being entered in a URL

if ($_SERVER['REQUEST_METHOD'] != “POST”){exit;}

// This line prevents a blank form being sent

while(list($key,$value) = each($_POST)){if(!(empty($value))){$set=1;}$message = $message . “$key: $value\n\n”;} if($set!==1){header(“location: $_SERVER[HTTP_REFERER]“);exit;}

// check if man or machine
if ($_POST['human'] “”){
echo “Bad doggy. Sit bobo. Sit.”;
exit;}