Online Ordering Verification

[lieut_data]

I'm new to this client / web design thing, so please bear with me. (I usually just do the programming, this time I'm fully in charge)

Anyway, I've a client that sells customized puzzles. I've made a simple website that shows off his puzzles / mazes, and a basic interface for the user to choose the customizations they can perform to their puzzles or mazes.

Once they "checkout", all I need to get is their contact and shipping information. My client doesn't want to do any credit card "stuff". I want to make sure that his checkout form is not spammed to death with false puzzle / maze requests.

How should I go about verifiying that a user, indeed, is a user? I.e., not a spam-bot?

Any suggestions for the newbie here ;-)

Thanks

[Dr Livingston]

Well I'd imagine that if they were a user then they would have their details in a database table somewhere ? Have them log in as a user and check that way, no ?

[Andy Tomaka]

The larger sites (IE: Slashdot and Yahoo!) have implemented a dynamic image checker. Basically, when the user goes to the registration form an image is dynamically created with some sort of word or string of numbers. This string of numbers is made so that it can't be read by even an image reader (blurry text among other things) and the user is only able to register if he/she puts in the correct text. It's kind of a nifty way to do it but I imagine it takes some time.

If I remember correctly, Invision Board does this (if you choose to have it do so) with images of numbers so you may want to look to that code for ideas.

[Hartmann]

Yes, the dynamic image checker is a great way to make sure the visitor isn't someone who is just spamming. You could also make sure that the e-mail address they supply is valid by having an e-mail sent to the one they provide and having that e-mail link to the final step in sending in their order. That will allow you to make sure they supplied a correct e-mail address and you then have it on file as well.

As a safety measure, I would keep track of all IPs and hostnames of those who submit orders, that way if you do have a problem with spam, you can track it down.

[lieut_data]

Well I'd imagine that if they were a user then they would have their details in a database table somewhere ? Have them log in as a user and check that way, no ?

Sorry for not catching up on my thread, was away for the weekend
By user, I really mean random client -- not usually a repeat client, but just a once-in-a-lifetime purchaser.

Thanks for suggestions all! I think I may try something along the lines of Andy & Hartmann's ideas.