Mike’s Technology Blog

Spammers are among the most innovative people in the net. Like virus programmers, they seem to be able to find new means to send their spam and bypass existing protection. What most webmasters do nowadays to prevent spammers from harvesting email addresses from their website is to put an email contact form instead of posting their actual email address on their website. So instead of seeing user@domain.com in their ‘Contact Us’ page, you will see a contact form instead. This worked well in the beginning but now, the spammers found another way and they made it worst! Instead of just harvesting emails from our websites, they now use our resources to send their spam. This can result to a slowing down of the server to blacklisting of the server’s IP which is very very bad!

This problem was brought to my attention by Benj Arriola who he himself has posted an article on how to prevent email contact form spamming.

So how do they do it? First, let’s look at how most contact forms look like. Most contact forms will have these:

• Name of Sender
• Email of Sender
• Message Subject
• Email Message

What the spammers do is simply include email headers in these fields in the correct format and let your code do the rest. How? Like this:

1. They put the name of sender that they want.
2. They put the email of sender that they want
3. Then in message subject, they first type the following in some plain text editor such as notepad:
   Subject that they want
   Bcc: recipient1@domain.com,recipient2@domain.com,…
   They can enter as many Bcc recipients as they want
4. They type their spam message
5. They click submit and poof! The email gets sent to all the Bcc recipients using your server’s resources and identity.

Bad? you bet! So how do we solve this? Here are few tips. Assuming we have the following form:

Name of Sender :

Email of Sender :

Subject :

Message : 

In sendmail.php, you do this:

// anti-spam code
list ($sender_name) = explode ("\\n", $_POST['sender_name']);
list ($sender_email) = explode (”\\n”, $_POST['sender_email']);
list ($subject) = explode (”\\n”, $_POST['subject']);
$message = “\\n\\n” . $_POST['message'];

// email sending code goes here…

So what exactly did we do?

The first three lines of the anti-spam code simply gets only the first line of whatever was placed in our sender_name, sender_email, and subject fields. This effectively removes extra header fields that the spammers could have placed in them.

On the other hand, the fourth line adds two extra spaces before the the start of message effectively disabling possible headers that the spammers may have placed in the message body.

This code is tested and seems to work for now… We can never tell when these spammers will find a new workaround.

Lastly, I’m sorry if I wasn’t able to explain this much clearer. I’m typing this in a short span of time only. If you need clarifications, please feel free to post them as comments below and I will try to answer your queries.