如何阻止垃圾邮件发送者将 http 输入到数据库表单中
我有一个将信息发送到数据库表中的表单。我用 Javascript 检查了它，但是当 Javascript 关闭时，阻止垃圾邮件发送者使用 PHP 输入 http 等内容到数据库的最佳方法是什么？
I have a form that sends info into a database table. I have it checked with a Javascript but what is the best way to stop spammers entering http and such into the database with PHP when Javascript is turned off?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（5）
您可以在表单上实施验证码：
http://en.wikipedia.org/wiki/CAPTCHA
编辑：也一定要验证服务器端的表单数据并像往常一样检查 html 标签等，但验证码应该有助于防止自动垃圾邮件攻击。
You could implement a CAPTCHA on the form:
http://en.wikipedia.org/wiki/CAPTCHA
Edit: Also definitely verify form data on the server side and check for html tags etc as usual, but the CAPTCHA should help against automated spam attacks.
永远不要相信客户。始终验证服务器端的所有数据。用于表单验证的 JavaScript 只是一个附加功能。您可以从基本的 PHP 函数开始检查内容是否包含您不喜欢的某些字符串，例如。 “http://”。
if (strpos('http://', $_POST['message']) !== false) { /* refuse */ }Never trust the client. Always validate all data on server side. JavaScript for form validation can just be an additional feature. You could start with basic PHP functions to check if the content contains certain strings you don't like, eg. "http://".
if (strpos('http://', $_POST['message']) !== false) { /* refuse */ }您可以使用CSRF保护来防止垃圾邮件发送者，我发现它非常有效。
它是什么和工作原理
另一种偷偷摸摸的方法是包含一个“蜜罐”字段 - 一个永远不应该与内容一起提交的隐藏字段。如果已满，您就知道这是垃圾邮件。这两种方法都不需要烦人的验证码。
You can use CSRF protection to prevent spammers, I have found it quite effective.
What it is and how it works
Another sneaky method is to include a "honeypot" field - a hidden field that should never be submitted with content. If it's filled, you know it's spam. Neither of these methods require an annoying CAPTCHA.
有两件事需要考虑，应该并行实施（也许还有更多）。
好吧，对于验证码，无论如何你都必须在服务器端进行验证。但即使您决定不实施验证码，您也应该在服务器端进行数据验证。
There are two things to consider which should be implemented in parallel (maybe there's more).
Well, for CAPTCHA you'll have to make it's verification on server side anyway. But even if you decide not to implement captcha, you should make data verification on server side.
我建议在之前使用
htmlentities()函数做你的插入。显然，您的插入应该使用 参数化查询 进行交互数据库也是如此。验证码当然是一个选项，但它更多的是限制某人可以发布的频率，而不是他们可以发布的内容。使用 hmtl 转义（同样是
htmlentities()函数）来防止用户输入您不想要的内容。I suggest using the
htmlentities()function before doing your insert.Obviously your insert should be done using parametrized queries to interact with the database as well. captcha is certainly an option, but it more serves to limit how often someone can post, not what they can post. Use hmtl escaping (again, the
htmlentities()function) to prevent the user from inputting things you don't want.