I have a PHP web contact form I put together which checks for spam words and cleans out any HTML coding before sending, but I am receiving some messages with gobbledegook, which I believe the sender is sending out. For what reason I cannot gather other than to see what they can get from it?




From: rOjhZkYyBMG [email address removed for this example]

How do I check for this sort of thing using PHP before sending, so it can be rejected like spam messages?

I have seen pspell_check but I feel that this could reject a message which could have a genuine typo in it.

Note: I have extensively tested the contact form sending code by sending test messages through it and all messages go through as they should so it's not the PHP I have put in that is garbling the message

  • Surely you wouldn't reject a message for a single misspelling even if were were to check all the words with a spell checker. – Stephen Ostermiller Sep 25 '20 at 15:41
  • @StephenOstermiller that's what I'm saying. I wouldn't want that to happen. – Chris Rogers Sep 25 '20 at 16:04

I think pspell is the wrong approach: misspellings can and do happen -- and of course there are words like proper nouns that even if spelled correctly might trigger an error in pspell.

We had a similar issue with account signups on our website. More or less random information was being used to create the account. It turned out (not surprisingly) that all of these fake submissions were created by bots, so we added a captcha to our sign up form and the problem was solved. It wasn't a huge problem to begin with, but we went from a couple of dozen fake accounts a day to basically zero.

For our purposes, we decided to use reCAPTCHA v3 because it doesn't even require any user interaction, it was easy to set up, and it was free (see: https://developers.google.com/recaptcha/docs/versions). That said, there are dozens of alternatives should you prefer. Regardless, judging by the type of data you're getting, I'm pretty certain your issue is being caused by bots too and a captcha or other human-verification system should solve your problem.

As an aside, you may wish to check your log files to see which networks, countries, etc. are responsible for these fake submissions. My guess is you'll start noticing some patterns. We did. So we tightened up the security checks for certain types of data coming from certain countries -- and banned other networks entirely from accessing our system (think: large, shady server farms in countries where internet lawlessness is rampant.) If you decide to go the ban route, you can do so on the application level (such as in your PHP scripts), in your web server configuration (e.g., httpd.conf) or by using a third-party service such as CloudFlare. (In addition to doing IP checks, CloudFlare allows you to ban entire ASNs which I find super useful.)

Good luck!

  • For a good UX I have been looking for methods without annoying my website visitors. ReCAPTCHA v3 is interesting. I didn't even bother looking at reCAPTCHA as even I hate it when I have to do the silly photo clicking tests etc. before I can do anything on some sites. I will take a look at that. Thanks – Chris Rogers Sep 26 '20 at 7:41
  • 1
    Any idea why someone would use a bot to send a garbled message? – Chris Rogers Sep 26 '20 at 7:43
  • @Chris Rogers, reCAPTCHA v3 works well. You'll have to note it in your privacy policy, depending on where your website is hosted and which countries your website serves. – Paddy Landau Sep 27 '20 at 3:40

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.