With some advice from SO, I developed this system, which I think is quite strong for bots to automatically post comments.


<script type="text/javascript" src="jquery.js"></script>
function main()
 var str=$("#key").load("getToken.php",function (responseText) {
 setTimeout("main()", 100000);
 <body onload='main()'>
 <form name="f" action="poster.php" method="post">
  <input type="text" name="text"/><br>
  <input type="text" name="key" id="key" value=""/><br>
  <input type="submit">


 $key=date("Y-m-d H:i:s");
 echo $key.'#'.$hash;


if (!isset($_POST['key']))

$parts = explode('#',$_POST['key'],2);
$key = $parts[0];
$hash = $parts[1];

$date1 = $key;
$date2 = date("Y-m-d H:i:s");
$diff = abs(strtotime($date2) - strtotime($date1)); 
$years   = floor($diff / (365*60*60*24)); 
$months  = floor(($diff - $years * 365*60*60*24) / (30*60*60*24)); 
$days    = floor(($diff - $years * 365*60*60*24 - $months*30*60*60*24)/ (60*60*24));
$hours   = floor(($diff - $years * 365*60*60*24 - $months*30*60*60*24 - $days*60*60*24)/ (60*60)); 
$minuts  = floor(($diff - $years * 365*60*60*24 - $months*30*60*60*24 - $days*60*60*24 - $hours*60*60)/ 60); 
$seconds = floor(($diff - $years * 365*60*60*24 - $months*30*60*60*24 - $days*60*60*24 - $hours*60*60 - $minuts*60)); 

if ($seconds < 5)
 echo $seconds.' Too fast, must be a naughty bot <br>';
else if ($seconds>5 && $seconds < 600)
 echo $seconds.' In time <br>';
 echo $seconds.' time out <br>';

if ($hash == (sha1($key.'sou')))
 echo $_POST['text'];
 echo 'You are a bot !';

2 Answers 2

  • 365*60*60*24 should be a constant.

  • You should really improve your variable naming.

    $date2 = date("Y-m-d H:i:s");
  • date2? Does that say anything? currentTime is more like it. Always describe what variables contain, not what they are.

  • Isn't $diff already the number of seconds?

  • Most part of the date/time checking could be rewritten to:

    $seconds = time() - strtotime($key);
  • \$\begingroup\$ Yes, you are correct ! But anything else which can enhance the security or something like that ? \$\endgroup\$
    – Sourav
    May 11, 2011 at 10:04
  • \$\begingroup\$ the security part is fine \$\endgroup\$
    – jgauffin
    May 11, 2011 at 10:07
  • \$\begingroup\$ But i think a bad human can program a bot which gets the token fill it in a dummy form and submit. any way to stop that ? \$\endgroup\$
    – Sourav
    May 11, 2011 at 10:10
  • 1
    \$\begingroup\$ if a bot visit getToken.php , he get the token and filled it in a hidden field named KEY, and submit the form :( \$\endgroup\$
    – Sourav
    May 11, 2011 at 11:45
  • 1
    \$\begingroup\$ @Sourav: no you didn;t. \$\endgroup\$ May 26, 2011 at 13:03

Why are you using abs()?

Why are there a 6-7 lines of code to just get the number of seconds between each timestamp? Just use the diff between $_SERVER['REQUEST_TIME'] and whatever time is pulled out of the token.

If all you are doing is checking the speed of the submit, ie. between page load and subsequent submit of the form, then you don't need a fancy hashed token - and you definitely don't need any javascript! Just write in the page load time into a hidden field, or store it in a session and compare to the submit time.

Also, most bots disable javascript, so that invalidates your entire solution.

My advice: Sign up to askimet or another 3rd party spam service, roll your own spam detection library with a bunch of keywords / phrases.

Don't take this the wrong way - a good attempt & keep up the effort! :)


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.