Programmers Stack Exchange is a question and answer site for professional programmers interested in conceptual questions about software development. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Why don't browsers have the ability to differentiate between events triggered via input devices and scripts ex: element.onEvent()? Wouldn't this be a very simple way counter attack web spam bots? Or am I way off on this?

share|improve this question
Remember, javascript runs on the client, which can choose to do whatever it wants with it. The client can be modified in any imaginable (or unimaginable) way for spam bots to work - they don't have to run on IE/FF/Chrome/etc. – configurator Dec 28 '10 at 23:51
@configurator - True! – Babiker Dec 29 '10 at 0:12

The event model of javascript is totally irrelevant to how spam bots work. Spam bots work by submitting forms to the server, not by running code on the client browser. In fact, most bot-submitted spam would have never gone through a "browser" at all.

You would need some way to differentiate between a bot-submitted form, and a user-submitted form, which is actually not possible (after all, the bot just needs to "copy" what a user would have submitted and there'd no way for the server to tell the difference).

Also, one thing I've been noticing recently is that a lot of "spam" (e.g. comment spam on blogs, etc) is not actually bot-submitted anymore. Captcha and email verification etc has made it more cost-effective for the spammers to employ people in 3rd-world countries a couple of cents an hour to manually go in and submit their spam. So any technique which relies on differentiating between humans and bots is becoming less and less effective.

share|improve this answer

Probably because the event handler is simply a function like any other. If you put a "source" argument into it, all the malicious code would need to do is call the event handler manually and pass the "from user input" value.

share|improve this answer
But you would at least know a human is spamming, right? CAPTCHAs would be one less thing for users to go through. – Babiker Dec 28 '10 at 23:20
@Babiker: Not really. What's to stop that from being put into an automated script? – Mason Wheeler Dec 28 '10 at 23:36

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.