I recently suffered massive bot attacks against my contact page. Someone sent me over 350 e-mails from my form in less than a couple of hours. As this form only sends e-mail to an address dedicated for this purpose, this isn't more than an inconvenience. In re-writing it, I decided to write better stripslash and strip_tags functions of my own. I have the function stripping out left and right angle brackets, and forward and back slashes. I replace these with blanks (I am the only one that views these e-mails and I think I can figure out what was meant). That should break most script and malicious html tags.
What else should I watch for and strip? I thought it might be wise to replace "=" signs with blanks. Should I worry about words like "query" or "fopen"? Part of my solution to preventing bot attacks against my form is to force manual input by varying the name="" values. I have eighteen different possibilities for each field on the form. I choose which to use randomly. I check each possibility when processing to see if it is set and send posters to a 404 page if they post to the wrong or all possible variables. I also include a random string of 5 digits as an authorization code in a hidden field. I use mysql database to let the processing page know what variables and authorization code to expect, associated with the poster's ip. Use the wrong authorization code and you go to the 404 page. If your ip doesn't show up on in the database, you get a "404 page not found." I delete records from the database after processing, including old, unused entries where someone left without completely filling out the form. Does anyone see any reason that won't work to thwart the bots?
