# Anti-Bot comment system

With some advice from SO, I developed this system, which I think is quite strong for bots to automatically post comments.

index.php

<html>
<script type="text/javascript" src="jquery.js"></script>
<script>
function main()
{
var str=$("#key").load("getToken.php",function (responseText) {$("#key").val(responseText);
}
);
setTimeout("main()", 100000);
}
</script>
<form name="f" action="poster.php" method="post">
<input type="text" name="text"/><br>
<input type="text" name="key" id="key" value=""/><br>
<input type="submit">
</form>
</body>
</html>


getToken.php

<?php
$key=date("Y-m-d H:i:s");$hash=sha1($key.'mySecretKey'); echo$key.'#'.$hash; ?>  poster.php <?php if (!isset($_POST['key']))
exit;

$parts = explode('#',$_POST['key'],2);
$key =$parts[0];
$hash =$parts[1];

$date1 =$key;
$date2 = date("Y-m-d H:i:s");$diff = abs(strtotime($date2) - strtotime($date1));
$years = floor($diff / (365*60*60*24));
$months = floor(($diff - $years * 365*60*60*24) / (30*60*60*24));$days    = floor(($diff -$years * 365*60*60*24 - $months*30*60*60*24)/ (60*60*24));$hours   = floor(($diff -$years * 365*60*60*24 - $months*30*60*60*24 -$days*60*60*24)/ (60*60));
$minuts = floor(($diff - $years * 365*60*60*24 -$months*30*60*60*24 - $days*60*60*24 -$hours*60*60)/ 60);
$seconds = floor(($diff - $years * 365*60*60*24 -$months*30*60*60*24 - $days*60*60*24 -$hours*60*60 - $minuts*60)); if ($seconds < 5)
echo $seconds.' Too fast, must be a naughty bot <br>'; else if ($seconds>5 && $seconds < 600) echo$seconds.' In time <br>';
else
echo $seconds.' time out <br>'; if ($hash == (sha1($key.'sou'))) echo$_POST['text'];
else
echo 'You are a bot !';
?>


• 365*60*60*24 should be a constant.

• You should really improve your variable naming.

$date2 = date("Y-m-d H:i:s");  • date2? Does that say anything? currentTime is more like it. Always describe what variables contain, not what they are. • Isn't $diff already the number of seconds?

• Most part of the date/time checking could be rewritten to:

$seconds = time() - strtotime($key);

• Yes, you are correct ! But anything else which can enhance the security or something like that ? May 11, 2011 at 10:04
• the security part is fine May 11, 2011 at 10:07
• But i think a bad human can program a bot which gets the token fill it in a dummy form and submit. any way to stop that ? May 11, 2011 at 10:10
• if a bot visit getToken.php , he get the token and filled it in a hidden field named KEY, and submit the form :( May 11, 2011 at 11:45
• @Sourav: no you didn;t. May 26, 2011 at 13:03

Why are you using abs()?

Why are there a 6-7 lines of code to just get the number of seconds between each timestamp? Just use the diff between \$_SERVER['REQUEST_TIME'] and whatever time is pulled out of the token.

If all you are doing is checking the speed of the submit, ie. between page load and subsequent submit of the form, then you don't need a fancy hashed token - and you definitely don't need any javascript! Just write in the page load time into a hidden field, or store it in a session and compare to the submit time.

Also, most bots disable javascript, so that invalidates your entire solution.