Block spam from “tell a friend” forms

Question

You have to have a form on your website for people to send an email to a friend if they found something interesting. You can force people to be logged in (which is not a good option in my case). You can make time delay (this is not really urgent email, so it can wait for 5 minutes). Do you have this problem? How would you solve it?

Edit: I am mostly interested in stopping manual spam

Answer 1

Do you have a problem with automated scripting of your form, or people genuinely using it too much?

The simple solution to the bot problem is a Captcha, such as ReCaptcha. The user-friendliness is questionable, but it would perhaps solve your problem.

Answer 2

You can also use something different from all those captcha scripts. Let me tell you what I do: - I create a md5 hash:

$secretWord='TryToHashMe';
$formID='myForm';
$md5Value=md5($secretWord.$formID);

echo '<input type="hidden" name="form-check" value="'.$md5Value.'">';
echo '<input type="hidden" name="bot-check" value="">';

those are 2 very simple ways because: 1) auto bots try to fill all your inputs and 2)the hash is not provided, this mean you have a post request from outside your site. The hashing could be extended with some session or cookie, too.

All the best!

Answer 3

I would recommend a Captcha or if you would like something a bit less intrusive, have a simple math problem(which changes) so you just have something like:

For spam protection: Type what Two Plus Two is here _________

I did this on my personal website and never had a problem(and I had a lot of attempts that failed by spambots)

Answer 4

This service has very good anti-spam measures.

http://www.tellafriendking.com/features.php?showall=1#spam-free

FYI, I am involved with the company, so I'm not entirely unbiased, but we do get a lot of refugees who come to us to end their spam problems with other services or downloaded scripts.

Edit:

If you feel the need to vote down, perhaps you should leave a comment too...

Answer 5

The best solution is to use an all-purpose bot filtering solution. I know this is an old post, but a new botnet was discovered that uses these send to a friend modules to send spam (not a new technique but some interesting new advancements).

According to one security vendor (good tips), “At a minimum, they should include a rate-limiting mechanism that will prevent an IP address from issuing unreasonable numbers of requests over a specific period of time. Other DIY solutions are to have all users fill in CAPTCHAs and to enforce registration as a prerequisite to sending out an email message.”