CODEWITHSUNDEEP
php
user1537415
user1537415

Reputation:

PHP return false if certain word appears in $_POST[xxx]

I have a coming soon form at a website where user fills out an email form and it will be emailed to me. However, a spammer has hit the site and is spamming the form with goatse and so on. IP ban isn't helping so I need to stop the form sending it if it contains goatse or something. Here's the mailer.

<?php
$SPOSTI =$_POST[sposti];


if ($SPOSTI=="")
{
    return false;
}

if ($SPOSTI=="goatse.fr")
{
    return false;
}
if ($SPOSTI=="http://www.goatse.info/hello.jpg")
{
    return false;
}
else
{
    $to = "[email protected]";
    $subject = "xxx";
    $message = "$_POST[sposti] haluaa tiedon kun kotisivut.name avautuu.
    $_POST[ip]";
    $from = "$_POST[sposti]";
    $headers = "From:" . $from;
    mail($to,$subject,$message,$headers);
}
    ?>

Is there someway to block it from executing the code if the email contains a certain word (goatse in this case)

Upvotes: 0

Views: 290

Answers (4)

alkar
alkar

Reputation: 5511

Try the following:

function is_spam($array, $block_pattern){
    $block = false;
    foreach($array as $k => $v){
        if(preg_match('/.*' . $block_pattern . '.*/', $k) ||
           preg_match('/.*' . $block_pattern . '.*/', $v)){
            $block = true;
            break;
        }
    }

    return $block;
}

Usage: is_spam($_POST, 'goatse');
Returns: true if 'goatse' is found in $_POST

The function will search all keys and values of $array for the $block_pattern string and will return true if the pattern is found.

Upvotes: 0

ChrisK
ChrisK

Reputation: 1218

You can use stristr http://php.net/manual/de/function.stristr.php to achive this. I would recommend to using a captcha, since it is more efficient. A popular solution is reCaptcha: https://developers.google.com/recaptcha/docs/php Another, weaker possibility is to add a security question to your form, for instance "What is five plus five in numbers?".

Upvotes: 0

user1454661
user1454661

Reputation:

strpos() will let you find a substring, but I really recommend a captcha security system as the attacker could simply switch to another annoying word.

Goatse's arn't your problem here, it's the security.

Upvotes: 0

Blaster
Blaster

Reputation: 9080

You need to use exit or die instead of return false which works inside functions/methods:

if ( $SPOSTI =="" || strpos('goatse', $SPOSTI) !== FALSE)
{
   exit();
}

Upvotes: 1

Related Questions