Best option to secure a form

[Adun]

Hello Everyone,

I'm back with another question .
I'm wondering what is the best option to secure the sending of the form.

1- The captcha:

I dislike this option. It's very difficult to include to my template.... The result is very ugly and even for the user the captcha is unreadable most of the time.

2- The hidden field:

I think that it's a smart option.
I add a hidden text input into my form. It's defined as invisible in the Css file.

Code: Select all

<input name="test" class="testInvisible" type="text" />

Before sending the form, I check the value for this field. If the value is not null, it means that the form has been filled by non-human.


What do you think? Do you have other options?
For me the option2 is good because it's not visible for the user.

[jratunh21]

I'd go with the captcha my friend. Just use a different captcha lol

[RedEye]

2- The hidden field:

I think that it's a smart option.
I add a hidden text input into my form. It's defined as invisible in the Css file.

Code: Select all

<input name="test" class="testInvisible" type="text" />

Before sending the form, I check the value for this field. If the value is not null, it means that the form has been filled by non-human.

That is everything, but not a smart option!
Do you really think that bot coders are stupid idiots?
Coders can not only write code, they also can read it and by reading yours they would notice that this field is not used...

1. every of your forms should include <?php echo Html::_('form.token'); ?>
2. use captcha if you like

[Adun]

Hello RedEye and thanks for your answer.

Coders can not only write code, they also can read it

You are right but I think most of them(>99%) do not explore the css file. That's why I was using the class parameter. Apparently this method is quite efficient.

. every of your forms should include <?php echo Html::_('form.token'); ?>

From my understanding, this line protects against attack type "Cross-site request forgery" (CSRF). So it's important but it does not protect against form filling bot.

What do you think?