Tell me more ×
Programmers Stack Exchange is a question and answer site for professional programmers interested in conceptual questions about software development. It's 100% free, no registration required.
up vote 3 down vote favorite
1

I have designed my first website recently. I created my own blog like thing in PHP. I write articles and below the articles there is a place to add comments.

Sometimes I get random comments something like 'sd$^&(87&(*2d10hsdasko' with no meaning. There are hundreds of them. I think some silly person with lots of time must be playing with my website for fun. I am thinking of finding his IP address and blocking it.

Has someone faced such a problem? How do you prevent people from playing with your website?

share|improve this question
1  
Probably a silly question, but are you sure it's not a language or character-encoding issue? – Steve314 Jul 24 '11 at 19:51
I don't think so. I tested my website with English comments and it correctly gets inserted in the database and shows it correctly. And I just started my website and only a few of my friends know about it. I don't think any legitimate person would put 100s of comments. I think some of my friends is just troubling me. – Prem Mehta Jul 24 '11 at 19:56
2  
its not one person with a lot of time, its probably a script some spammer is using to hit many thousands of forms on many thousands of sites. – GrandmasterB Jul 24 '11 at 20:15
2  
Are you using a CAPTCHA? – Cracker Jul 24 '11 at 20:22
1  
Also make sure your website is designed to handle sql injection attacks. – Joe Internet Jul 25 '11 at 3:53
show 1 more comment

2 Answers

up vote 7 down vote

1. Log users activity

You can't know what's happening on your server if you're not logging anything. Sometimes, you may not even know for months that something wrong is happening if you're never looking at logs.

When somebody does something wrong, you may want to find the concerned IP address or addresses. Then, use WHOIS to gather more information about the person.

2. Protect your forms against bots

CAPTCHA is helpful especially on such forms where anyone can post anything on your website. You are lucky that you're spammed with meaningless messages. More often, this spam contains links to porn websites and other sweet things. Do you really want to be associated in Google and other browser engines with those websites?

3. Protect your forms against morons

CAPTCHA will not prevent an human to spend a whole day posting manually some malicious comments. To prevent such behavior, you may want to limit the number of authorized postings by hour by IP. This will not prevent the person to post those comments while switching proxy servers, but will require more effort and time.

4. Review and accept

Before the content is actually posted on your website, you may also want to review it manually to be able to prevent any malicious comment to actually appear on your website. Again, this is a good idea if you actually care about your reputation in Google search.

5. Reserach

If nothing works (for example a human is posting from different proxy servers), you may want to search for patterns which makes the difference between the spammer and other people. In your case, it would probably be the form of the messages and the number of special characters and digits compared to the number of small and capital letters.

share|improve this answer
2  
+1 for all good ideas. Here is one to add just for general info - but only if you have the resources and the required direct control over your site. Daily (or weekly) refresh your site to a known state. That is, wipe your live site, and restore a known clean version from a backup. Set this up automatically, of course. That way you automatically remove any defacing attempts or spam bots that got inserted into your site through a security hole. (Yes, there is more to this suggestion - it takes a bit of planning and building, but the idea is used by php.opensourcecms.com for example). – Martin S. Stoller Jul 24 '11 at 21:07
+1 great post on the ways to get around one of the more annoying sides of the public domain. – user29981 Jul 24 '11 at 21:51
1  
2b. Also add rel="nofollow" to any links in comments to tell Google etc. that you're not really associated with that site. – Peter Taylor Jul 25 '11 at 5:54
up vote 2 down vote

Looks like you are being spammed. Are you using a CAPTCHA?

People write automated scripts which add comments to blogs or other websites automatically. One of the ways to prevent this is to use a CAPTCHA.

share|improve this answer
Any explanation for downvote? – Cracker Jul 25 '11 at 20:24

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.