Posted by Chris Hope on 09/15/05 00:56

Paul Marshall wrote:

> Hi
>
> I am my wits end! I have a PHP script running that captures variables
> posted from a form on the previous page. The script then emails the
> results using the mail() function.
>
> The script is currently being spammed in two ways:
>
> 1) The page is being loaded directly, therefore emailing blank results
> 2) The variables are made up of an accepted email address (all
> variables
> are filled with it). This email address is random, created using any
> cobinations of characters before the accepted domain.
>
> Does anyone have any ideas of how I can stop this? The mails are
> exceeding 60 per day now! Obviously it is some form of program doing
> it but I don't know of a way that I can stop it, either to restrict
> the variables or the script page or what?
>
> Any help would be much appreciated!

If all the fields are always being filled out with the same info then
check for that ie if they're all the same and they all contain your
email address then don't send the email.

I've noticed this happening on some of the sites I manage. Generally
what's actually happening is they're inserting a newline break in one
of the fields and attempting to add additional headers to the email
(including mime type headers to make it into a multipart document and
hide the rest of the submitted data).

The way I've been combating this is to check none of the single line
fields (eg first name, last name etc) contain newline characters, and
none of the multi line fields (eg message) contain 'Content-Type:',
'multipart/mixed' or 'boundary='. If any of them match the above then
they get a message back saying the form contained invalid data.

--
Chris Hope | www.electrictoolbox.com | www.linuxcdmall.com

[Back to original message]