Contact/Email Form Exploits (ASP)

[Zoran]

I've had some problems with email form exploits in the past. There are basically two things spammers are doing with email forms. Most of us that have been around for a while know about this. For those that don't, here is how it works.

1. The worst one is they use your email form to send out their spam through your email form to others. Gives stormhosts a headache as they don't want to have their server blacklisted.

2. More annoying than anything else, spammers use your email form to send you spam. How desperate can you be to sell viagra??

To take care of #1, just use the function below to validate your all form fields.

Function ValidForm(strField)	
	If instr(1, lcase(strField), "content-type") > 0 OR inStr(1, strField, "%0a", 1) > 0 OR inStr(1, strField, "%0d", 1) > 0 OR inStr(1, strField, "\n", 1) > 0 OR inStr(1, strField, "\r", 1) > 0 OR inStr(1, lcase(strField), "cc:", 1) > 0 OR inStr(1, lcase(strField), "to:", 1) > 0 Then
		ValidForm = false
	Else
		ValidForm = true
	End If
End Function

If the function returns true, just send your email. If false, exit out to whatever method you prefer.

For #2, I found that checking to see if your email script is being requested from your site, not some other, is enough to stop those annoying spam through your form. Use the following.

If Instr(1, Request.ServerVariables("HTTP_REFERER"), "yourdomain.com", 1) < 1 Then Response.Redirect("/errorpage.html")

Basically it checks if the email processing script was referred through your website. If not, you send the somewhere else. Personally, I would send them here.
Also, the above will take care of #1 in a lot of cases.

If there are any other ideas to improve or streamline this, I would love to hear it.

[Will]

The HTTP referrer idea is good but would prevent anyone with a referrer-less browser from using your form. Some people turn off the referrer header for privacy reasons. spammers are probably also likely not to send the referrer header, or if they're really smart - they'll just set it to the page they're requesting.

Could you give more information on your first function? Is that looking for control characters used by spammers to send multiple emails?

[Mipsuinc]

Im trying to make an asp page that can edit cascading style sheets. If anyone has any idea on how to do this, or if its even possible, please help.

Thnx.