Webmasters Stack Exchange is a question and answer site for pro webmasters. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have my own comment system with some rudimentary spam protection. Recently I started getting a few comments that appear to be automated with the name "XlsUoIGh" and the content "doors.txt;10"

I deleted the first set of comments, thinking it was probably nothing. However, they came back. They're constrained to one page and usually only 2 or 3 are posted. I've heard online that this text serves as a "bookmark" for future spammers to find and use. Is this true? I've also heard of similar pieces of content being posted like "door.txt;6" What does the number mean?

share|improve this question

Things like that are test strings used by spam bots to verify if your commenting system is susceptible to attack. If your commenting systems displays the message bot instantly marks it as target. Additional checks are often made later on to see for how long did message last, and if your site still can be targeted.

Best prevention method would be either to use some form of basic CAPTCHA (not necessarily reCaptcha, as it was cracked several times already and currently is one of most frustrating captchas for end-users), or user tracking through session (eg. you cannot write message in under 10 second from loading the page) - perhaps with additional "blacklist" of words that will forbid posting the message.

It's not 100% secure, but definitely will discourage most of basic spambots (it won't defend you from a directed attacks though.

share|improve this answer
Well, currently I have a basic honeypot system with no intentions of adding a captcha. I guess it'll just have to be smarter about it – Earlz Feb 13 '13 at 15:41
As said - probably the easiest way is to use session data to store $_SESSION['lastPageLoadTimestamp'] with time() and then when posting comment - compare it with current time stamp. If the difference is below 10s you should be free to pop an error. Either someone attempted to write something meaningless or is a spam bot, as there's no way anyone would load the page, read at least one paragraph of content and than post meaningful response in below 10s. Meanwhile spambots rarely wait more than 5s before posting (usually they just load and instantly post message for maxed efficiency). – MarcinWolny Feb 13 '13 at 15:55

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.