dream04110 2019-03-22 18:42
浏览 80

PHP邮件:蜜罐方法的概念

I was thinking of how I (or we) could build a fully functional PHP form that could do two things:

  • Be randomly generated
  • Keep original formatting when parsing to e-mail

For anyone who's not familiar with the honeypot method I will briefly explain it. The honeypot method uses a visually invisible field (display: none) that should be kept empty when posted. Because bots will only inspect the source code it will be very likely that a bot will automatically fill in this field and thus be blocked by a if / else check when the form is posted.

I wrote a concept that explains the algorithm that has to do this. I added a few example arrays, just to demonstrate.

I'm very curious if someone could help me strengthen the method. Is this safe enough? Or is there something that I'm missing.


$fields = [
    [
        "name" => "name",
        "type" => "text",
        "class" => "input--text",
        "required" => true
    ],
    [
        "name" => "email",
        "type" => "text",
        "class" => "input--text",
        "required" => true
    ],
    [
        "name" => "phone",
        "type" => "text",
        "class" => "input--text",
        "required" => true
    ],
];

$classes = [
    "input--town",
    "input--city",
    "input--country",
    "input--date",
    "input--subject",
    "input--town",
    "input--town",
];

$names = [
    "city",
    "birthday",
    "genre",
    "location",
    "agreement",
    "year",
    "month",
    "day",
    "strength",
];

$types = [
    "date",
    "email",
    "text",
    "time",
    "search",
    "checkbox",
    "radio",
    "week",
];

// $_POST
$_POST = [
    "birthday" => "",
    "name" => "Jim",
    "city" => "",
    "email" => "text@example.com",
    "phone" => "1234567890"
];

$fields = (count($fields) + rand(2, 6));

// Concept algorithm
/*

    === Goal
    Randomize both real and fake fields in order to prevent 
    AI / Spider(s) / Bot(s) to figure out our honeypot method

    === Parsing of field
    - For loop the amount of fields
    - Create new array with fields
    - Include the fields with index $i in new array (with encrypted CSS order slug, md5 into sha1 with substring)
    - If all included randomize the remaining (random: class, random: type, random: order)
    - Shuffle array
    - Loop and parse into <form></form>
    - Add ReCAPTCHA

    === Retrieving of $_POST and markup of e-mail
    - Check for ReCAPTCHA validity
    - Loop through $_POST
    - Check:
        - If "name" in $names => If so => check if empty. If empty, continue
            - Save all collected $_POST fields to new array
            - Loop through the original array of $fields
            - Use name attribute in fields to index $_POST fields
            - Escape, sanitize and parse to e-mail message
            ---------
            - DONE => Send 
            ---------
        - Else => It's a field that should be empty so it's filled by a bot... SPAM!

    === Featured
    - Random amount of fields (both fake and true)
    - Randomized order of fields in HTML
    - Structurized with CSS
    - Algorithmic check if fake or real field
    - Keep original field order in e-mail markup
  • 写回答

0条回答 默认 最新

    报告相同问题?

    悬赏问题

    • ¥15 无线电能传输系统MATLAB仿真问题
    • ¥50 如何用脚本实现输入法的热键设置
    • ¥20 我想使用一些网络协议或者部分协议也行,主要想实现类似于traceroute的一定步长内的路由拓扑功能
    • ¥30 深度学习,前后端连接
    • ¥15 孟德尔随机化结果不一致
    • ¥15 apm2.8飞控罗盘bad health,加速度计校准失败
    • ¥15 求解O-S方程的特征值问题给出边界层布拉休斯平行流的中性曲线
    • ¥15 谁有desed数据集呀
    • ¥20 手写数字识别运行c仿真时,程序报错错误代码sim211-100
    • ¥15 关于#hadoop#的问题