Canvas Support

reCAPTCHA Version 2 works, but I got SPAM over formular

7 replies·opened Jul 25, 2021
O
ovetterJul 25, 2021

Hallo,
now I try to use reCAPTCHA 2 , but I receive SPAM.
attachment

Formularcode:

<div class="col-md-4">
						
														<div class="widget quick-contact-widget form-widget clearfix">

								<h4>Kurzmitteilung</h4>

								<div class="form-result"></div>

								<form id="quick-contact-form" name="quick-contact-form" action="../include/form.php" method="post" class="quick-contact-form mb-0">

                               	  <div class="form-process">
										<div class="css3-spinner">
											<div class="css3-spinner-scaler"></div>
										</div>
									</div>

									<div class="input-group mx-auto">
										<div class="input-group-prepend">
											<div class="input-group-text"><i class="icon-user"></i></div>
										</div>
										<input type="text" class="required form-control" id="quick-contact-form-name" name="quick-contact-form-name" value="" placeholder="Vorname/ Name" />
									</div>
								  <div class="input-group mx-auto">
										<div class="input-group-prepend">
											<div class="input-group-text"><i class="icon-email2"></i></div>
										</div>
										<input type="text" class="required form-control email" id="quick-contact-form-email" name="quick-contact-form-email" value="" placeholder="Email Adresse" />
																		</div>
									<textarea class="required form-control input-block-level short-textarea" id="quick-contact-form-message" name="quick-contact-form-message" rows="4" cols="30" placeholder="Mitteilung"></textarea>
									<input type="text" class="d-none" id="quick-contact-form-botcheck" name="quick-contact-form-botcheck" value="" />
									<input type="hidden" name="prefix" value="quick-contact-form-">
                                    
                                    
                                     
										<script src="https://www.google.com/recaptcha/api.js" async defer></script>
										<div class="input-group mx-auto g-recaptcha"  data-sitekey="6LeIE7MbAAAAAP2bxG8Jb8q3qE1mSyAJElJXP8sL"></div>
                                        
                                                         
   
                                    
                                 <button type="submit" id="quick-contact-form-submit" name="quick-contact-form-submit" class="btn btn-danger m-0"   value="submit">Email abschicken</button>
                                    
                                </form>

							</div>
                          
                      </div>

**
File form.php:**

<?php

/*-------------------------------------------------

	Form Processor Plugin
	by SemiColonWeb

---------------------------------------------------*/

/*-------------------------------------------------
	PHPMailer Initialization
---------------------------------------------------*/

use PHPMailer\PHPMailer\PHPMailer;
use PHPMailer\PHPMailer\Exception;

require 'phpmailer/src/Exception.php';
require 'phpmailer/src/PHPMailer.php';
require 'phpmailer/src/SMTP.php';

/*-------------------------------------------------
	Receiver's Email
---------------------------------------------------*/

$toemails = array();

$toemails[] = array(
				'email' => 'redaktion@elbsandsteingebirge.de', // Your Email Address
				'name' => 'Redaktion Elbsandsteingebirge Verlag' // Your Name
			);

/*-------------------------------------------------
	Sender's Email
---------------------------------------------------*/

$fromemail = array(
				'email' => 'info@elbsandsteingebirge.de', // Company's Email Address (preferably currently used Domain Name)
				'name' => 'Elbsandsteingebirge Portal' // Company Name
			);

/*-------------------------------------------------
	reCaptcha
---------------------------------------------------*/

// Add this only if you use reCaptcha with your Contact Forms
$recaptcha_secret = '6LeIE7MbAAAAAF8SazPWwVXiKHiP0DzeIGMOIjj6'; // Your reCaptcha Secret

/*-------------------------------------------------
	PHPMailer Initialization
---------------------------------------------------*/

$mail = new PHPMailer();

/* Add your SMTP Codes after this Line */

// End of SMTP

/*-------------------------------------------------
	Form Messages
---------------------------------------------------*/

$message = array(
	'success'			=> 'Wir haben <strong>erfolgreich</strong> Ihre Mail erhalten und werden uns kurzfristig zurückmelden.',
	'error'				=> 'Die Email <strong>konnte nicht</strong> zugestellt werden. Es trat ein unerwarteter Fehler auf. Bitte kontaktieren Sie uns per Telefon.',
	'error_bot'			=> 'Ein Internet Bot wurde erkannt! Die Mail wurde nicht versandt! Bitte versuchen Sie es später noch einmal!',
	'error_unexpected'	=> 'Es trat ein <strong>unerwarteter Fehler</strong> auf. Bitte versuchen Sie es später noch einmal!',
	'recaptcha_invalid'	=> 'Captcha not Validated! Bitte versuchen Sie es noch einmal!',
	'recaptcha_error'	=> 'Captcha not Submitted! Bitte versuchen Sie es noch einmal!'
);

/*-------------------------------------------------
	Blocked Words from Forms
---------------------------------------------------*/

$spam_keywords = array(
	'viagra',
    'querdenker',
    'afd', 
    'faschist',
    'nazi', 
    'hass', 
    'idiot', 
    'ausländer',
    'hitler',
	'cialis',
	'levitra'
);

/*-------------------------------------------------
	Form Processor
---------------------------------------------------*/

if( $_SERVER['REQUEST_METHOD'] == 'POST' ) {

	$prefix		= !empty( $_POST['prefix'] ) ? $_POST['prefix'] : '';
	$submits	= $_POST;
	$botpassed	= false;

	$message_form					= !empty( $submits['message'] ) ? $submits['message'] : array();
	$message['success']				= !empty( $message_form['success'] ) ? $message_form['success'] : $message['success'];
	$message['error']				= !empty( $message_form['error'] ) ? $message_form['error'] : $message['error'];
	$message['error_bot']			= !empty( $message_form['error_bot'] ) ? $message_form['error_bot'] : $message['error_bot'];
	$message['error_unexpected']	= !empty( $message_form['error_unexpected'] ) ? $message_form['error_unexpected'] : $message['error_unexpected'];
	$message['recaptcha_invalid']	= !empty( $message_form['recaptcha_invalid'] ) ? $message_form['recaptcha_invalid'] : $message['recaptcha_invalid'];
	$message['recaptcha_error']		= !empty( $message_form['recaptcha_error'] ) ? $message_form['recaptcha_error'] : $message['recaptcha_error'];

	/*-------------------------------------------------
		Bot Protection
	---------------------------------------------------*/

	if( isset( $submits[ $prefix . 'botcheck' ] ) ) {
		$botpassed = true;
	}

	if( !empty( $submits[ $prefix . 'botcheck' ] ) ) {
		$botpassed = false;
	}

	if( $botpassed == false ) {
		echo '{ "alert": "error", "message": "' . $message['error_bot'] . '" }';
		exit;
	}

	/*-------------------------------------------------
		SPAM Protection
	---------------------------------------------------*/

	function spam_keyword_check( $submitted, $spamwords ) {
		if( is_array( $submitted ) ) {
			return false;
		}
		if( !is_array( $spamwords ) ) $spamwords = array( $spamwords );
		foreach( $spamwords as $spamstring ) {
			if( ( $position = stripos( $submitted, $spamstring ) ) !== false ) return $position;
		}
		return false;
	}

	foreach( $submits as $spam_submit ) {
		if( spam_keyword_check( $spam_submit, $spam_keywords ) ) {
			// A successful message is displayed to the submitter that makes him think that the Form has been sent so that he cannot modify the keywords to prevent SPAM
			echo '{ "alert": "success", "message": "' . $message['success'] . '" }';
			exit;
		}
	}

	/*-------------------------------------------------
		reCaptcha
	---------------------------------------------------*/

	if( isset( $submits['g-recaptcha-response'] ) ) {

		$recaptcha_data = array(
			'secret' => $recaptcha_secret,
			'response' => $submits['g-recaptcha-response']
		);

		$recap_verify = curl_init();
		curl_setopt( $recap_verify, CURLOPT_URL, "https://www.google.com/recaptcha/api/siteverify" );
		curl_setopt( $recap_verify, CURLOPT_POST, true );
		curl_setopt( $recap_verify, CURLOPT_POSTFIELDS, http_build_query( $recaptcha_data ) );
		curl_setopt( $recap_verify, CURLOPT_SSL_VERIFYPEER, false );
		curl_setopt( $recap_verify, CURLOPT_RETURNTRANSFER, true );
		$recap_response = curl_exec( $recap_verify );

		$g_response = json_decode( $recap_response );

		if ( $g_response->success !== true ) {
			echo '{ "alert": "error", "message": "' . $message['recaptcha_invalid'] . '" }';
			exit;
		}
	}

	$template	= !empty( $submits['template'] ) ? $submits['template'] : 'html';
	$html_title	= !empty( $submits['html_title'] ) ? $submits['html_title'] : 'Kurzanfrage von elbsandsteingebirge.de';
	$forcerecap	= ( !empty( $submits['force_recaptcha'] ) && $submits['force_recaptcha'] != 'false' ) ? true : false;
	$replyto	= !empty( $submits['replyto'] ) ? explode( ',', $submits['replyto'] ) : false;

	if( $forcerecap ) {
		if( !isset( $submits['g-recaptcha-response'] ) ) {
			echo '{ "alert": "error", "message": "' . $message['recaptcha_error'] . '" }';
			exit;
		}
	}

	/*-------------------------------------------------
		Auto-Responders
	---------------------------------------------------*/

	$autores	= ( !empty( $submits['autoresponder'] ) && $submits['autoresponder'] != 'false' ) ? true : false;
	$ar_subject	= !empty( $submits['ar_subject'] ) ? $submits['ar_subject'] : 'Thanks for your Email';
	$ar_title	= !empty( $submits['ar_title'] ) ? $submits['ar_title'] : 'Its so good to hear from You!';
	$ar_message	= !empty( $submits['ar_message'] ) ? $submits['ar_message'] : 'Autoresponder Message';

	preg_match_all('#\{(.*?)\}#', $ar_message, $ar_matches);
	if( !empty( $ar_matches[1] ) ) {
		foreach( $ar_matches[1] as $ar_key => $ar_value ) {
			$ar_message = str_replace( '{' . $ar_value . '}' , $submits[ $ar_value ], $ar_message );
		}
	}

	$ar_footer	= !empty( $submits['ar_footer'] ) ? $submits['ar_footer'] : 'Copyrights &copy; ' . date('Y') . ' <strong>SemiColonWeb</strong>. All Rights Reserved.';

	$mail->Subject = !empty( $submits['subject'] ) ? $submits['subject'] : 'Formularanfrage von www.elbsandsteingebirge.de';
	$mail->SetFrom( $fromemail['email'] , $fromemail['name'] );

	if( !empty( $replyto ) ) {
		if( count( $replyto ) > 1 ) {
			$replyto_e = $submits[ $replyto[0] ];
			$replyto_n = $submits[ $replyto[1] ];
			$mail->AddReplyTo( $replyto_e , $replyto_n );
		} elseif( count( $replyto ) == 1 ) {
			$replyto_e = $submits[ $replyto[0] ];
			$mail->AddReplyTo( $replyto_e );
		}
	}

	foreach( $toemails as $toemail ) {
		$mail->AddAddress( $toemail['email'] , $toemail['name'] );
	}

	$unsets = array( 'prefix', 'subject', 'replyto', 'template', 'html_title', 'message', 'autoresponder', 'ar_subject', 'ar_title', 'ar_message', 'ar_footer', $prefix . 'botcheck', 'g-recaptcha-response', 'force_recaptcha', $prefix . 'submit' );

	foreach( $unsets as $unset ) {
		unset( $submits[ $unset ] );
	}

	$fields = array();

	foreach( $submits as $name => $value ) {

		if( empty( $value ) ) continue;

		$name = str_replace( $prefix , '', $name );
		$name = mb_convert_case( $name, MB_CASE_TITLE, "UTF-8" );

		if( is_array( $value ) ) {
			$value = implode( ', ', $value );
		}

		$fields[$name] = $value;

	}

	$files = $_FILES;

	foreach( $files as $file => $filevalue ) {

		if( is_array( $filevalue['name'] ) ) {

			$filecount = count( $filevalue['name'] );

			for( $f = 0; $f < $filecount; $f++ ) {
				if ( isset( $_FILES[ $file ] ) && $_FILES[ $file ]['error'][ $f ] == UPLOAD_ERR_OK ) {
					$mail->IsHTML(true);
					$mail->AddAttachment( $_FILES[ $file ]['tmp_name'][ $f ], $_FILES[ $file ]['name'][ $f ] );
				}
			}

		} else {

			if ( isset( $_FILES[ $file ] ) && $_FILES[ $file ]['error'] == UPLOAD_ERR_OK ) {
				$mail->IsHTML(true);
				$mail->AddAttachment( $_FILES[ $file ]['tmp_name'], $_FILES[ $file ]['name'] );
			}

		}

	}

	$response = array();

	foreach( $fields as $fieldname => $fieldvalue ) {
		if( $template == 'text' ) {
			$response[] = $fieldname . ': ' . $fieldvalue;
		} else {
			$fieldname = '<tr>
								<td class="hero-subheader__title" style="font-size: 16px; line-height: 24px; font-weight: bold; padding: 0 0 5px 0;" align="left">' . $fieldname . '</td>
							</tr>';
			$fieldvalue = '<tr>
								<td class="hero-subheader__content" style="font-size: 16px; line-height: 24px; color: #777777; padding: 0 15px 30px 0;" align="left">' . $fieldvalue . '</td>
							</tr>';
			$response[] = $fieldname . $fieldvalue;
		}
	}

	$referrer = $_SERVER['HTTP_REFERER'] ? '

Das Formular stammt von: ' . $_SERVER['HTTP_REFERER'] : '';

	$html_before = '<table class="full-width-container" border="0" cellpadding="0" cellspacing="0" height="100%" width="100%" bgcolor="#eeeeee" style="width: 100%; height: 100%; padding: 50px 0 50px 0;">
				<tr>
					<td align="center" valign="top">
						<!-- / 700px container -->
						<table class="container" border="0" cellpadding="0" cellspacing="0" width="84%" bgcolor="#ffffff" style="width: 84%;">
							<tr>
								<td align="center" valign="top">
									';

	$html_after = '<!-- /// Footer -->
								</td>
							</tr>
						</table>
					</td>
				</tr>
			</table>';

	if( $template == 'text' ) {
		$body = implode( "
", $response ) . $referrer;
	} else {
		$html = $html_before . '<!-- / Header -->
									<table class="container header" border="0" cellpadding="0" cellspacing="0" width="84%" style="width: 84%;">
										<tr>
											<td style="padding: 30px 0 30px 0; border-bottom: solid 1px #eeeeee; font-size: 30px; font-weight: bold; text-decoration: none; color: #000000;" align="left">
												' . $html_title . '
											</td>
										</tr>
									</table>
									<!-- /// Header -->

									<!-- / Hero subheader -->
									<table class="container hero-subheader" border="0" cellpadding="0" cellspacing="0" width="84%" style="width: 84%; padding: 60px 0 30px 0;"">
										' . implode( '', $response ) . '
									</table>

									<!-- / Footer -->
									<table class="container" border="0" cellpadding="0" cellspacing="0" width="100%" align="center">
										<tr>
											<td align="center">
												<table class="container" border="0" cellpadding="0" cellspacing="0" width="84%" align="center" style="border-top: 1px solid #eeeeee; width: 84%;">
													<tr>
														<td style="color: #d5d5d5; text-align: center; font-size: 12px; padding: 30px 0 30px 0; line-height: 22px;">' . strip_tags( $referrer ) . '</td>
													</tr>
												</table>
											</td>
										</tr>
									</table>
									' . $html_after;

		$body = $html;
	}

	if( $autores && !empty( $replyto_e ) ) {
		$autoresponder = new PHPMailer();

		/* Add your Auto-Responder SMTP Codes after this Line */

		// End of Auto-Responder SMTP

		$autoresponder->SetFrom( $fromemail['email'] , $fromemail['name'] );
		if( !empty( $replyto_n ) ) {
			$autoresponder->AddAddress( $replyto_e , $replyto_n );
		} else {
			$autoresponder->AddAddress( $replyto_e );
		}
		$autoresponder->Subject = $ar_subject;

		$ar_body = $html_before . '<!-- / Header -->
					<table class="container header" border="0" cellpadding="0" cellspacing="0" width="84%" style="width: 84%;">
						<tr>
							<td style="padding: 30px 0 30px 0; border-bottom: solid 1px #eeeeee; font-size: 30px; font-weight: bold; text-decoration: none; color: #000000;" align="left">
								' . $ar_title . '
							</td>
						</tr>
					</table>
					<!-- /// Header -->

					<!-- / Hero subheader -->
					<table class="container hero-subheader" border="0" cellpadding="0" cellspacing="0" width="84%" style="width: 84%; padding: 60px 0 30px 0;"">
						<tr>
							<td class="hero-subheader__content" style="font-size: 16px; line-height: 26px; color: #777777; padding: 0 15px 30px 0;" align="left">' . $ar_message . '</td>
						</tr>
					</table>

					<!-- / Footer -->
					<table class="container" border="0" cellpadding="0" cellspacing="0" width="100%" align="center">
						<tr>
							<td align="center">
								<table class="container" border="0" cellpadding="0" cellspacing="0" width="84%" align="center" style="border-top: 1px solid #eeeeee; width: 84%;">
									<tr>
										<td style="color: #d5d5d5; text-align: center; font-size: 12px; padding: 30px 0 30px 0; line-height: 22px;">' . $ar_footer . '</td>
									</tr>
								</table>
							</td>
						</tr>
					</table>
					' . $html_after;

		$autoresponder->MsgHTML( $ar_body );
	}

	$mail->MsgHTML( $body );
	$mail->CharSet = "UTF-8";
	$sendEmail = $mail->Send();

	if( $sendEmail == true ):

		if( $autores && !empty( $replyto_e ) ) {
			$send_arEmail = $autoresponder->Send();
		}

		echo '{ "alert": "success", "message": "' . $message['success'] . '" }';
	else:
		echo '{ "alert": "error", "message": "' . $message['error'] . '

<strong>Reason:</strong>
' . $mail->ErrorInfo . '" }';
	endif;

} else {
	echo '{ "alert": "error", "message": "' . $message['error_unexpected'] . '" }';
}

?>

Please help ...
Thanks

S
SemiColonWebSTAFFJul 26, 2021

Hello,

We have checked the Forms Code and they appear to be fine. The standard Honey-Pot spam protection works and also reCaptcha v2. But please note that SPAM Bots are always evolving. SPAM that are coming through are not really Bot SPAMs but looks like Human SPAM which can’t be prevented directly. You can provide us with your FTP Details and we can setup reCaptcha v3 for you which should be more effective.

Hope this Help!

Let us know if we can help you with anything else or if you find any further issues.

O
ovetterJul 27, 2021

Hallo,
what you need to setup reCAPTCHA v3 ?

Can I solve this by my self?
I am not authorized to provide the FTP access.

I use Canvas V5.

Thanks O.Vetter

S
SemiColonWebSTAFFJul 27, 2021

Hello,

The reCaptcha v3 Codes should work fine out of the Box by default provide that the reCaptcha api v3 keys and key permissions are correctly configured according to your Website.

Use this Code in the HTML File replacing the Old reCaptcha v3 Codes:

<div class="col-12 form-group">
	<input type="hidden" id="g-recaptcha-response" name="g-recaptcha-response">

	<script src="https://www.google.com/recaptcha/api.js?render=YOUR-SITE-KEY"></script>
	<script>
	grecaptcha.ready(function() {
		grecaptcha.execute('YOUR-SITE-KEY', {action: 'contact_page'}).then(function(token) {
			// add token value to form
			document.getElementById('g-recaptcha-response').value = token;
		});
	});
	</script>

</div>

and for the include/form.php File we have attached the Latest File here.

Hope this Helps!

Let us know if we can help you with anything else or if you find any further issues.

O
ovetterJul 27, 2021

Hallo ,
what means:

// add token value to form
document.getElementById('g-recaptcha-response').value = token;

I only understand, that I have to input my 'YOUR-SITE-KEY'.

Must I change also other values ?

Thanks O.Vetter

S
SemiColonWebSTAFFJul 27, 2021

You will just need to change YOUR-SITE-KEY in the Codes. And then your Secret Key in the include/form.php File.

That's it.

O
ovetterJul 28, 2021

Hallo,
I try it next week. I'm in vacation.

Thanks.

S
SemiColonWebSTAFFJul 28, 2021

Sure. Please do let us know if you are facing any further issues.

Safe Vacations. :)

Have the same question, or something new?

Sign in to the Canvas dashboard to reply or open your own topic. Canvas owners get direct help from the SemiColonWeb team.

Reply on the dashboard