So, I finally got around to looking at the comments on articles from a little while ago. It has been a little over two months since I wrote my new administrative backend and added the ability to post comments to my blog. While writing it, I took the blissful mentality that spambots would only spam Wordpress installations due to their incredibly popular nature. I suppose this isn't the case.

On two articles, a bot (from multiple IP addresses, but with the same scheme in the email address) advertised cheap drugs. Only now did I notice, and finally remove them. This bit of spam got me to thinking.

I have used the concept of captcha systems before. Have the user input a series of random numbers and letters, or even use a list of short dictionary words. I've always hated having to fill these out. They only prove an annoyance to anyone who trying to post a legitimate comment. However, they are great at fighting spam. I went in search of a better way to prevent seeing Viagra ads on my site.

From my friend TomB I learned about the reverse captcha idea. I decided I would go ahead and try it.

The idea is instead of having a human prove they're human, have the bot prove it's a bot. We do this by using some creative CSS. First off, instead of naming your email field in your comment box "email," name it something unique. Now we can move onto the CSS and HTML hackery.

<div style="display: none;">
	<input name="email" type="text" />
</div>

The CSS attribute "display" dictates whether the object on the page should be displayed at all. To hide everything in the div, we use "display:none" to hide all the code from just about every web browser that supports CSS. To spam bots, this will display a standard box where the bot will put a fake email address. Now, we have to refuse the comment from being posted. We do this by adding this to whatever file adds the comments. This should preferrably be added as close to the top as possible.

if (!empty($_POST['email'])) { die("Spambots aren't welcome here. Have a nice day."); };

This simply checks if the field was posted to the script using PHP, and if it was, deny any further PHP actions on the page. Therefore, comments are blocked by spambots that can't tell that the field is not a real email field and is allowed for real users who can't actually see the field.

Go ahead and test it out, comments are enabled!