2
\$\begingroup\$

I have written a function that I want to protect from spam bots. I have used two techniques the first being filter after submit. After reading around I obtained the foreach loop from here and I have also written a piece of code that uses the spam honeypot protection technique.

However what I need to be checked over is whether or not the function is sufficient to prevent spam bots. I have used the framework silex and twig. Below is my function;

$app->post('/login', function(Request $request) use($app) {
        $email = $app['request']->get('email');
        $password = $app['request']->get('password');

       //security validation to make to make sure that a spammer bot is not hijacking our form to send spam to other people
       foreach($this->get('request')->request->all() as $value){
           if(stripos($value,'Content-Type:') !== FALSE){
              echo "There was a problem with the information you entered.";
               exit;
            }
        }

     //security validation uses spam honeypot technique to make sure that the address field is blank
         $postcode = $app['request']->get('postcode');
         if($postcode != ""){
                echo "Your form submission has an error";
                exit;
         }

        if ($app['auth']->login($email, $password)) {
                return $app->redirect('/');
        } else {
                return $app->redirect('/login');
        }
});

and below is what I have in my twig file;

<form class="form-signin" action="/login" method="post">
        <h2 class="form-heading">Login</h2>
        <label for="inputEmail" class="sr-only">Email address</label>
        <input type="email" id="inputEmail" class="form-control" name="email" placeholder="Email address" required>
        <label for="inputPassword" class="sr-only">Password</label>
        <input type="password" id="inputPassword" class="form-control" name="password" placeholder="Password" required>
        <label for="inputPostcode" class=sr-only">Postcode</label>
        <input type="text" id="inputPostcode" class="form-control" name="postcode" placeholder="Leave this field blank" style="display:none;"/>
        <button class="btn btn-lg btn-default btn-block" type="submit">Sign in</button>
</form>

EDIT

As mentioned in my comment below I got the error

Fatal error: Using $this when not in object context in /var/www/html/index.php on line 80

However a simple change from using the $this->get('request')->request->all() code to storing the post values in an array and then looping through the array works. So now my function looks like this;

$app->post('/login', function(Request $request) use($app) {
    $email = $app['request']->get('email');
    $password = $app['request']->get('password');
     $postcode = $app['request']->get('postcode');
    //stored post values in array
     $post = array($email,$password);
        //security validation to make to make sure that a spammer bot is not hijacking our form to send spam to other people
        foreach($post as $value){
             if(stripos($value,'Content-Type:') !== FALSE){
                 echo "There was a problem with the information you entered.";
                 exit;
         }
         }

         //security validation uses spam honeypot technique to make sure that the address field is blank

         if($postcode != ""){
                echo "Your form submission has an error";
                exit;
        }

        if ($app['auth']->login($email, $password)) {
                return $app->redirect('/');
        } else {
                return $app->redirect('/login');
        }
});

So it works again, so my original question of is this function worthy of preventing spamming.

Now an additional query about the use of the array to store the post values, as I have other functions (register, reset password, etc) is storing the values in the array the best way to go about it? Is there not a way I can use the silex code $this->get('request')->request->all() to obtain the values to loop through?

\$\endgroup\$
  • \$\begingroup\$ I have just noticed I am getting an error when trying to login now the error reads Fatal error: Using $this when not in object context in /var/www/html/index.php on line 80 maybe I'll move this question over to Stack Overflow? \$\endgroup\$ – mp252 Mar 31 '16 at 21:05

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.