3

I have a PHP web contact form I put together which checks for spam words and cleans out any HTML coding before sending, but I am receiving some messages with gobbledegook, which I believe the sender is sending out. For what reason I cannot gather other than to see what they can get from it?

Example

RULITldVgsx
tMeIkngCroURjmD
OEThYoJiXWBvte
hrqWJFdKnlx

Message:
ZKIqcNxhtdPG

From: rOjhZkYyBMG [email address removed for this example]

How do I check for this sort of thing using PHP before sending, so it can be rejected like spam messages?

I have seen pspell_check but I feel that this could reject a message which could have a genuine typo in it.

Note: I have extensively tested the contact form sending code by sending test messages through it and all messages go through as they should so it's not the PHP I have put in that is garbling the message

2
  • Surely you wouldn't reject a message for a single misspelling even if were were to check all the words with a spell checker. Sep 25, 2020 at 15:41
  • @StephenOstermiller that's what I'm saying. I wouldn't want that to happen. Sep 25, 2020 at 16:04

2 Answers 2

4

I think pspell is the wrong approach: misspellings can and do happen -- and of course there are words like proper nouns that even if spelled correctly might trigger an error in pspell.

We had a similar issue with account signups on our website. More or less random information was being used to create the account. It turned out (not surprisingly) that all of these fake submissions were created by bots, so we added a captcha to our sign up form and the problem was solved. It wasn't a huge problem to begin with, but we went from a couple of dozen fake accounts a day to basically zero.

For our purposes, we decided to use reCAPTCHA v3 because it doesn't even require any user interaction, it was easy to set up, and it was free (see: https://developers.google.com/recaptcha/docs/versions). That said, there are dozens of alternatives should you prefer. Regardless, judging by the type of data you're getting, I'm pretty certain your issue is being caused by bots too and a captcha or other human-verification system should solve your problem.

As an aside, you may wish to check your log files to see which networks, countries, etc. are responsible for these fake submissions. My guess is you'll start noticing some patterns. We did. So we tightened up the security checks for certain types of data coming from certain countries -- and banned other networks entirely from accessing our system (think: large, shady server farms in countries where internet lawlessness is rampant.) If you decide to go the ban route, you can do so on the application level (such as in your PHP scripts), in your web server configuration (e.g., httpd.conf) or by using a third-party service such as CloudFlare. (In addition to doing IP checks, CloudFlare allows you to ban entire ASNs which I find super useful.)

Good luck!

4
  • For a good UX I have been looking for methods without annoying my website visitors. ReCAPTCHA v3 is interesting. I didn't even bother looking at reCAPTCHA as even I hate it when I have to do the silly photo clicking tests etc. before I can do anything on some sites. I will take a look at that. Thanks Sep 26, 2020 at 7:41
  • 1
    Any idea why someone would use a bot to send a garbled message? Sep 26, 2020 at 7:43
  • @Chris Rogers, reCAPTCHA v3 works well. You'll have to note it in your privacy policy, depending on where your website is hosted and which countries your website serves. Sep 27, 2020 at 3:40
  • 1
    also check out hcaptcha - a non google solution
    – Steve
    Feb 9, 2022 at 0:32
0

Another good solution is to create a verification word for sending. I have noticed that in many forums, you need to answer some questions first before posting a message.

2
  • Hi and welcome to Webmasters SE. This answer is a bit short for our Q&A format, and it's not entirely clear to me what you mean by "verification word" or by "answer some questions". I would welcome you to edit your answer to clarify and add more details. Thanks! Feb 9, 2022 at 0:43
  • It sounds like you could be talking about captcha systems as mentioned in the previous answer but as @MaximillianLaumeister points out, it is a bit unclear. Could you elaborate a bit on this? Feb 9, 2022 at 6:58

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.