在不打扰用户的情况下阻止 PHP 站点中的垃圾邮件
我目前正在开发一个小型聊天/论坛网站，该网站是我在周末粗略设计的，它有匿名条目（即：没有用户名或密码）。 这看起来对于垃圾邮件发送者来说很容易毁掉，但我不想用验证码或类似的反垃圾邮件输入来打扰用户。
除了这些之外，还有其他用户看不见的替代方案吗？ 感谢您的帮助。
I'm currently working on a little chat/forum site that I roughed out in a weekend, and it has anonymous entries (i.e.: no usernames or passwords). This looks like it could be easy-cake for a spammer to ruin, but I don't want to bother the user with captchas or similar anti-spam inputs.
Are there any invisible-to-the-user alternatives to these? Thanks for your help.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（5）
关于垃圾邮件发送者，您应该了解的一件事是，他们总是追求容易实现的目标。 与黑客相同。 我的意思是他们会选择最容易达到影响最多用户的目标。 这就是 PHP 和 Windows 漏洞经常被利用的原因：它们影响了如此多的用户，如果您发现这样的弱点/利用您的目标“市场”是巨大的。
这也是 Linux 和 Mac 操作系统相对不受病毒影响的一个重要原因，例如：目标市场远比 Windows 小。 现在，我并不将 Windows 的安全性和稳健性与 Mac/Linux 等同起来，但即使后两者的安全模型要好得多，针对前者的攻击数量仍然与它的缺陷不成比例。
我这样说是因为避免此类问题的最佳方法之一就是不要使用流行的软件。 例如，phpBB 仅仅因为它如此受欢迎就受到了很多攻击。
因此，通过创建自己的聊天/论坛系统，您会处于劣势，因为您的系统没有流行的现场测试功能，但您也有一个优势，因为它不值得大多数垃圾邮件发送者花时间来利用它。 因此，您需要注意的是自动化系统会对您产生什么不利影响。 网站上的联系表格往往具有可识别的标记（例如姓名、电子邮件和评论字段）。
所以我建议：
One thing you should know about spammers is they always go for the low-hanging fruit. Same with hackers. By this I mean they'll pick the easiest to hit targets that affect the most users. This is why PHP and Windows vulnerabilities are often exploited: they affect so many users that if you find such a weakness/exploit your target "market" is huge.
It's also a big part of the reason why Linux and Mac OSs remain relatively unscathed by viruses for example: the target market is much smaller than Windows. Now I'm not equating the security and robustness of Windows with Mac/Linux but even though the security model of the latter two is much better the number of attacks against the former is still disproportionate with the deficiencies it has.
I say this because one of the best ways to avoid these kinds of problems is not to use popular softare. phpBB for example has had lots of attacks made against it just because it's so popular.
So by doing your own chat/forum system you're at a disadvantage because you have a system that doesn't have the field-testing something popular does but you also have an advantage in that it isn't worth most spammer's time to exploit it. So what you need to watch out for is what can automated systems do against you. Contact forms on Websites tend to have recognizable markers (like name, email and comment fields).
So I would advise:
这不是一个防弹解决方案，但您可以有一些隐藏的输入字段。 如果这些不留空，那么您就发现了机器人。
机器人倾向于填写所有输入字段，而用户肯定会将他们看不到的字段留空。
Not a bomb-proof solution, but you can have some hidden input fields. If those are not left empty, you caught a bot.
Bots tend to fill all input fields, while users will sure leave fields they don't see empty.
这对我来说 100% 有效：
然后是服务器端（PHP）：
如前所述，大多数机器人都会填写所有内容，尤其是名为“电子邮件”的输入。
This has worked 100% of the time for me:
Then server side (PHP):
As mentioned earlier, most bots fill everything in, especially inputs named "email".
验证码的想法是，它们对于人类来说很容易通过，但对于机器人等来说却很难避免。 如果您不想要这种解决方案，那么如何阻止这些垃圾邮件机器人向您的网站发布信息呢？
这就像您希望计算机安全，但不想使用防病毒软件和防火墙一样。
我认为您可以为每个进入您网站的用户创建一个会话，并在他们第一次想要发布内容时向他们显示验证码（不需要登录，只需传递验证码）。 如果他们通过了，只需在会话中存储一个标志，表明他们是人类。 只要他们打开浏览器，他们就可以在您的网站上发布和回复他们想要的内容。 机器人不太可能通过第一个测试。
The idea of capchas is that they are very easy for humans to pass but very diffucult for bots etc. to avoid. If you don't want this kind of solution what will keep those spam-bots from posting to your site?
It's like you would like your computer to be safe but you don't want to use an antivirus and firewall.
I think you could create a session for every user that enters your site and first time they want to post something show them the capcha (don't require to log in, just pass capcha). If they pass it just store a flag in session that they are human. As long as they have their browser opened they can post and reply on your site what they want. Bots will unlikely pass this first test.
有两类反垃圾邮件保护。
首先是让自动化机器人很难将数据无意中放入您的网站。 为此经常提到隐藏表单字段方法，该方法适合低流量网站。 这些保护措施可能会被为您的网站编写的垃圾邮件机器人轻易破坏。 但如果你的目标太小，这种情况就不会发生。
第二种是“烦人”类型。 这通常涉及验证码、注册或邮件确认邮件。 您可以使用一些方法来减少这种麻烦，但需要机器人方面付出更多的努力来发布垃圾邮件。
请注意，这两种方法通常都会妨碍残疾人和移动用户。
There are two classes of anti-spam protection.
The first is to make it difficult for automated bots to stumble data into your site. The hidden form field method is frequently mentioned for this, and is suitable for low traffic sites. These protections can be trivially defeated by a spam bot written for your site. However if you are too small a target, this won't happen.
The second is the "bothersome" types. This usually involves a captcha, registration, or email confirmation of post. You can use a few approaches to make this less bothersome, but requires much more effort on the bot's side to post spam.
Note that both of these approaches can often impede disabled and mobile users.