We launched new forums in March 2019—join us there. In a hurry for help with your website? Get Help Now!
    • 19369
    • 1,098 Posts
    Hi,
    I used to have several spam comments (with jot) every day, and I didn’t want to enable captcha, so I tried the "honeypot" solution, and is working very very well.
    Here is the link that explains how it works: http://haacked.com/archive/2007/09/11/honeypot-captcha.aspx.

    I do not recommand to add it in a main release of jot because spammers can target specific CMS, but for little blog/websites I think that this is a very good alternative to the standard img captcha. If someone is interested in this solution I might write a blog post about it.
      • 3749
      • 24,544 Posts
      Like most spam-fighting techniques, It works until it doesn’t. wink

      SPForm, BTW, has had that built in from the beginning (though it uses neither JS, nor display:hidden to do the job) and, IIRC, it is turned on by default.

      I think FormIt also has that option.
        Did I help you? Buy me a beer
        Get my Book: MODX:The Official Guide
        MODX info for everyone: http://bobsguides.com/modx.html
        My MODX Extras
        Bob's Guides is now hosted at A2 MODX Hosting
        • 18373 ☆ A M B ☆
        • 3,141 Posts
        FormIt has it in the default template I think tongue
          Mark Hamstra • Developer spending his days working on Premium Extras and a MODX Site Dashboard with the ability to remotely upgrade MODX and extras to make the MODX world a little better.

          Tweet me @mark_hamstra, check my infrequent blog at markhamstra.com, my slightly more frequent ramblings at MODX.today or see code at Github.
          • 28042 ☆ A M B ☆
          • 24,524 Posts
          I’ve been using it with eForm for some time now with no complaints from clients and no spam from my contact form. I haven’t added it to my site’s Jot installation though.
            Studying MODX in the desert - http://sottwell.com
            Tips and Tricks from the MODX Forums and Slack Channels - http://modxcookbook.com
            Join the Slack Community - http://modx.org
            • 19369
            • 1,098 Posts
            Hi, so this is the code for jot:

            Open jot.class.inc.php and add this on line 547:
            		//-- Honeypot
            		if ($saveComment && !empty($_POST['body'])) {
            			$this->form['error'] = 10;
            			unset($pObj);
            			return;
            		}
            


            In jot template add this error: &10=I believe you’re a bot
            [+form.error:select=`
            &-3=You are trying to re-submit the same post. You have probably clicked the submit button more than once.
            &-2=Your comment has been rejected.
            &-1=Your comment has been saved, it will first be reviewed before it is published.
            &1=You are trying to re-submit the same post. You have probably clicked the submit button more than once.
            &2=The security code you entered was incorrect.
            &3=You can only post once each [+jot.postdelay+] seconds.
            &4=Your comment has been rejected.
            &5=[+form.errormsg:ifempty=`You didn't enter all the required fields`+]
            &10=I believe you're a bot. 
            `+]
            


            And somewhere in the form the html for the honeypot field
                
                <label id="bodyhp"><span>Body</span><br /> 
                <input class="form-input" name="body" type="text" value="" id="body" />
                </label>
            


            Finally some CSS to hide the form:
            label#bodyhp {
                display: block;
                height: 1px;
                overflow: hidden;
                padding-top: 1px;
            }
              • 19369
              • 1,098 Posts
              Quote from: sottwell at Feb 16, 2011, 02:02 PM

              I’ve been using it with eForm for some time now with no complaints from clients and no spam from my contact form. I haven’t added it to my site’s Jot installation though.

              Hi Susan, if you have time, can you share the eForm implementation of this?

              Thanks in advance.
                • 28042 ☆ A M B ☆
                • 24,524 Posts
                That’s why I have my Manager open for examination. However, for you...

                The relevant form field:
                <input tabindex="50" type="text" name="Last__Name" id="LastName" size=30 autocomplete="off" eform="LastName::0" />


                The snippet call (of course, the functions could both be in one snippet and the snippet run via the &runSnippet parameter):
                [!getServer!]
                [!checkField!]
                        [!eForm? &formid=`ContactForm` &tpl=`ContactForm` &report=`ContactReport` &to=`[email protected]` &subject=`sottwell.com Contact` &thankyou=`ThankYou` &from=`[+email+]` &fromname=`[+name+]` &replyto=`email` &eformOnBeforeMailSent=`getServer` &eformOnValidate=`checkField`!]


                And the checkField function:
                function checkField(&$fields,&$vMsg,&$rMsg) {
                    if(!empty($fields['Last__Name'])) {
                        return false;
                    } else {
                    return true;
                    }
                }

                I’ve been suspecting for some time that I could use a regex validation field in the eform attribute of the snippet call, but I’ve been too busy/lazy to look into it.
                  Studying MODX in the desert - http://sottwell.com
                  Tips and Tricks from the MODX Forums and Slack Channels - http://modxcookbook.com
                  Join the Slack Community - http://modx.org
                  • 19369
                  • 1,098 Posts
                  Thank you very very much Susan! This is going to be very userful.
                  Sorry I hadn’t thought about looking in your Manager!
                    • 4310
                    • 2,310 Posts
                    Based on Susans idea I’ve been using :
                    <input type="text" name="surname" id="surname" size="30" value="" autocomplete="off" eform="Surname::0:Must be a spam bot:#EVAL if(empty($_POST['surname']){return true;} else return false;" /> 

                    Seems to work okay
                      • 28042 ☆ A M B ☆
                      • 24,524 Posts
                      #EVAL - string of php code. Should return either true or false
                      deprecatedAlthough #EVAL still works in eForm 1.4 this rule will very likely no longer be supported in future versions. Use #FUNCTION instead.
                        Studying MODX in the desert - http://sottwell.com
                        Tips and Tricks from the MODX Forums and Slack Channels - http://modxcookbook.com
                        Join the Slack Community - http://modx.org