Anti-spam trick for Pixelpost

Version Française ici

I think I’m not the only one who have been bombarded by spambots with my pixelpost, I used to have up to 200 per day!

So I looked for a simple and efficient solution, and I think I found one because since I set up it half and a year ago, spams are just a bad souvenir…

Here is the idea:

Most of the spammers don’t go on you website (or perhaps just one time), usually they use automated systems which post malicious comments directly to the script that record them. Conclusion: they never use the comments form and so, they never click on the “Add comment” button.

The trick is to check if the button was “physically” clicked or not before recording.

There are two steps to set it up, you need to:

• Modify the form so that it is able to detect if the button was clicked or not.
• Modify the recording script so that it receives the result of the form and decide to record or not.

1. Edit your form:

First, what you need to do is to find where your comments form is located.
Most of the time it is in your template directory in image_template.html or in comment_template.html.

• Here is the change to do with the “simple” template of pixelpost 1.5:
  The Pixelpost 1.5 “simple” template uses a popup, so the comments form is located in comment_template.html

  ORIGINAL CODE (must be replaced by the modified code below):
  <input type='submit' value='Add' class="comment-button"/>

  MODIFIED CODE:
  <input id="you_are" type="hidden" name="you_are" value="aspambot"/> <input type="button" value="Add" class="comment-button" onclick="document.getElementById('you_are').value='ahuman'; this.form.submit();"/>

• For pixelpost 1.6 :
  This is exactly the same thing as for 1.5 version except that, for the “horizon” template, the form to edit is located in image_template.html.

1. Edit the recording script:

• For Pixelpost 1.5 :
  Open index.php and go to line 933 located at the beginning of the section “SAVE COMMENT”

  ORIGINAL CODE (must be replaced by the modified code below):
  if(isset($_GET['x'])&&$_GET['x'] == "save_comment")

  MODIFIED CODE:
  if(isset($_GET['x'])&&$_GET['x'] == "save_comment" && $_POST['you_are'] == "ahuman")

  Thus, comments will be recorded only if the value “ahuman” is received, so, if the button was clicked.

  Do the same thing at line 1025 located at the beginning of the section “EMAIL NOTE ON COMMENTS”. Thus, comments will be sent by email only if the value “ahuman” is received, so, if the button was clicked.

• For Pixelpost 1.6 :
  This is exactly the same thing as for 1.5 version except that the 2 lines to edit are located in includes/functions_comments.php at line 15 and 225.

Voilà !
Of course it doesn’t stop “manual spams”, but this kinds of spams are quite unusual. If spams suddenly start again, it is because they understood the trick and they are injecting the expected value “ahuman” with their scripts, so in this case, try to change the variable name “you_are” and its ideal value “ahuman” by something else.

Share This

This entry was posted on October 5, 2007 and is filed under Frequently Asked Questions. You can follow any responses to this entry through the RSS 2.0 feed. You can leave a response, or trackback from your own site.