Help with Contact Form Honeypot

PHP
1

I’ve set up a ‘Honeypot’ Contact Form, but still get spam.
Here is the code:

<head>
...
<style>
.zip{
visibility: collapse;
}
</style>
...
</head>

<body>
...
<form action='../submit.php' method='post' name='myform' onSubmit="return checkemail()">
<textarea name="message" value="placeholder text" input type="text" onfocus="this.style.color='#f2f2f2';
this.value='';">Contact us - Enter your message here...</textarea>

<input class="form-control" type="text" id="name" name="name" maxlength="50" placeholder="Name">
<input class="form-control" type="text" id="email" name="email" maxlength="50" placeholder="Email">

<input name="zip" type="text" id="zip" class="zip" autocomplete="false">

<input class="btn btn-action" type='submit' value="Send Message">
</form>
...
</body>

<?php
//check if form was sent
if($_POST){
$to = 'contactForm@....com';
$subject = 'ContactForm';

$name = $_POST['name'];
$email = $_POST['email'];
$message = $_POST['message'];
$headers = $name;
$message .= "\r\n\r\n" . $name;
//honey pot field
$honeypot = $_POST['zip'];
//check if the honeypot field is filled out. If not, send mail.
if( $honeypot > 1 ){
return;
}else{
mail( $to, $subject, $message, $email, $headers );
}
}
?>

I received several spam replies all similar to this (instead of legitimate email address, message and name):

wade.carlson@gmail.com

Contact us - Enter your message here…

5ad16ea0879f7

Any help/suggestions on how to fix this so no (or very little) spam gets sent, will be appreciated.

2

this makes no sense, you do not get any real numbers by a form, just check with

var_dump($honeypot);
var_dump($honeypot > 1);

what you need is empty().

also this is not a spam protection script, this is actually a spam bot itself

stop using mail(), take a wrapper like PHPMailer or Swiftmailer.

3

You’re using honeypot the wrong way. The honeypot is supposed to be invisible to human eyes. Bots typically type in any text field regardless of styles or JavaScript. If you are a legitimate person, modern browsers typically have CSS and JavaScript turned on. So you wouldn’t be seeing these honeypots.

4

Thanks for your replies.

What do you mean by: empty()
Can you give me an example using my current script, please?

Also, regarding “the honeypot is supposed to be invisible”,
as far I can see it doesn’t appear in the Form.
So, how am I using it “the wrong way”?

I look forward to any additional help.

5

This:-

1 Like
6

I was referring to the CSS. But it seems that collapse works. The next thing is what @chorn and @SamA74 was talking about. You have to make sure that the text field isn’t empty. If it isn’t empty, then a bot submtted something to it. This is where you can do extra work/

7

This topic was automatically closed 91 days after the last reply. New replies are no longer allowed.