4 ms·
I'm not sure it will work at all. Bots don't trigger the submit event by clicking a button. They do so by scripted form submission, so if the slider is tied to
by bradleyland 16y ago
I'm not sure it will work at all. Bots don't trigger the submit event by clicking a button. They do so by scripted form submission, so if the slider is tied to a simple submit event, it's pointless.
- itistoday 16y agoHow can you submit a form that has no URL to submit to? I haven't tried circumventing their form, and maybe they didn't do this, but the basic idea is to store the submission URL in javascript, and assign it to the form only on the slider event.
- johnrob 16y agoAll that matters is what goes over the wire. The UI doesn't matter. If the data sent has no dynamic component (i.e. the text of a random word-image), then it can be replayed with different inputs.
- there 16y agosurely spammers have javascript-enabled spambots by now. i'm sure some of them embed an actual webkit/mozilla/ie rendering engine and just script the interface. hell, a regular firefox browser with images disabled (for speed) and the selenium plugin installed could probably accomplish a high rate of automated spamming.
- studer 16y agoThe script just sets a hidden input field to a "magic" value once you've moved the slider all the way. If you can write a trivial regexp, you can circumvent their "captcha".
- itistoday 16y agoYou guys are misunderstanding me, I was referring to bots that autofill any form they come across on hundreds/thousands of sites, not about preventing a direct attack against this site. If someone wrote a bot specific to this site, yes, they'd easily get by it of course.
- chc 16y agoIf the slider is a true input, all you need to do is validate that input and reject any submissions with the wrong value.