Prevent website links and email addresses on a form when clicking Submit

Have you tried a hidden form via css (display: none) but in HTML as a normal form and call it email or something in general and if that form has data then it must be a bot.

You will need to iterate over all the fields of the $ _POST array (at least the ones you don't want emails or links in) and check against a couple of regexes.

The suggestion to use CAPTCHA is also good.

Anyway, here's a crappy implementation of the check:

class ValidationHelper
{
    // Regex taken from https://github.com/google-code-export/prado3/blob/master/framework/Web/UI/WebControls/TEmailAddressValidator.php
    const EMAIL_REGEX = "#\\w+([-+.]\\w+)*@\\w+([-.]\\w+)*\\.\\w+([-.]\\w+)*#";

    // hacked up regex that I just cooked up - could be hugely improved i'm sure.
    const LINK_REGEX = "#(h\s*t\s*t\s*p\s*s?|f\s*t\s*p)\s*:\s*/\s*/#";

    public static function containsEmail($value)
    {
        if (preg_match(self::EMAIL_REGEX, $value))
            return true;

        return false;
    }

    public static function containsLink($value)
    {
        if (preg_match(self::LINK_REGEX, $value))
            return true;

        return false;
    }
}

$errors = array();
foreach ($_POST as $key=>$value) {
    // presumably you want at least one email field, yeah?
    if ($key != 'email') {
        // perhaps you should be running strip_tags over everything if you don't want html and such...
        // see http://php.net/strip_tags for more info. without it (or something similar), there nothing 
        // to stop people from putting <script type="text/javascript" src="http://notyourdomain.com/~1337skriptkiddy/haxxors.js"></script>
        // into your form. even if you might not necessarily ever be displaying this in a scenario
        // where it can cause trouble, it never a bad idea to stop this stuff *before* it gets into your db
        $_POST[$key] = $value = strip_tags($value);
        if (ValidationHelper::containsEmail($value) || ValidationHelper::containsLink($value))
            $errors[] = 'Please ensure the value you entered for '.$fieldNames[$key].' does not contain any links or email addresses';
    }
}

if (!empty($errors)) {
    // failed - show errors.
}
else {
    // success!
}

      

        
        
        
      

    

Well, if you really want to fight spam, follow these steps:

• Put a CAPTCHA on the form so that non-people can't even submit the form. A very popular CAPTCHA implementation is reCAPTCHA .

• Do strip_tags on the fields so that even if someone has placed the urls manually, it will be removed.

• Check your email addresses regularly and remove them. Pick a good regular expression from the web that will display most email formats.

Hope for this help. Hooray!

Presumably you don't want to accept any HTML, just text? In this case, strip_tags is your friend. strip_tags also allows you to specify valid tags.

I would also heartily recommend enabling script-in-header protection .

People,

I tried using strip_tags, which certainly removes the tags, but does not remove the "mailto:" or "http: //" text, so the links are still links.

Is there a simple PHP command or routine that can scan a string and simply replace "mailto:" and / or "http: //" with a harmless empty string "" in those parts of the string?

Tried googling, but most of the stuff I found was about trimming the space, etc.

Sorry, I'm new to PHP.

Thanks and regards,

Tony