Johann almost added CAPTCHA verification to simpleblog 3, but he notes on his blog that he decided not to after looking at the pros and cons. He says that simpleblog isn’t a target of comment spam because of the inability to post html or javascript code into a comment. I disagree, however, because you still get targeted by comment spam by the very nature that bots will still post comments. Even with approval enabled, I still have to delete the pending comments, and there can be A LOT of them.
Johann included a copy of Emir Tuzul’s free ASP CAPTCHA implementation, but never incorporated it into simpleblog. I looked at how the code works and how Johann implemented comments, and I have successfully added CAPTCHA verification to the comments system. Since doing so a few days ago, not a single spam comment has been left. If you are interested, this is how to do it.
Since Johann included version 2 of the CAPTCHA code page, you do not need to download anything, but you can opt to use version 3 beta 1, which uses more character obfuscation to make it harder for bots to determine the characters in the image.
Edit functions.asp to add the following code to the end of the file, which is the verification function:
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 |
<% Function CheckCAPTCHA(valCAPTCHA) SessionCAPTCHA = Trim(Session("CAPTCHA")) Session("CAPTCHA") = vbNullString If Len(SessionCAPTCHA) < 1 Then CheckCAPTCHA = False Exit Function End if If CStr(SessionCAPTCHA) = CStr(valCAPTCHA) Then CheckCAPTCHA = True Else CheckCAPTCHA = False End if End Function %> |
Add the following code to functions.asp in the CommentsGet subroutine, which for me starts at line 351. It may be different for you since I think I have added other code higher in the file. This adds the actual CAPTCHA image to the comments form. You will add this code after the call for GetEmoticons and the line break, which for me means inserting this at line 454:
|
1 2 3 |
Type the characters shown in the image for verification. <img src="captcha.asp" alt="" width="86" height="21" /> <input name="strCAPTCHA" type="text" id="strCAPTCHA" maxlength="8" /></td> |
At line 481 (after the declaration of the str_userIP variable), insert this, which puts the characters entered into the form in a variable:
|
1 |
strCAPTCHA = Trim(Request.Form("strCAPTCHA")) |
Lastly, replace the code that inserts the comment into the database with the code below, starting at line 492 (after the comment "insert Comment." Instead of simply inserting the comment into the database, this will compare the entered characters to the actual ones in the image. If they match, the comment is inserted. If not, I use a JavaScript alert to present a popup box and then redirect the user back to the post:
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 |
If CheckCAPTCHA(strCAPTCHA) = True Then SQL = "INSERT INTO T_COMMENTS(c_content, c_name, c_email, c_url, c_bID_fk,ip) VALUES ('" & strComment & "','" & sanitize( strName ) & "','" & sanitize( strEmail ) & "','" & sanitize( strUrl )& "'," & sanitize( bID )& ",'"&str_userIP&"')" Set MyConn = Server.CreateObject("ADODB.Connection") MyConn.Open strConn MyConn.Execute(strSQL) MyConn.Close Set MyConn = Nothing Response.Redirect("default.asp?view=plink&id=" & bID & "&comments=1") Else %> <script language="Javascript"> alert('You did not type the verification code correctly.'); location.replace('default.asp?view=plink&id=<%= bID %>&comments=1'); </script> <% End If |
You’re done! Save functions.asp and then go add a comment to one of your posts. Intentionally enter incorrect characters to confirm the popup works and that the comment did not get added. The only thing missing from this is that it doesn’t preserve the comment in the session. This means that if a real person incorrectly enters the code, when returned to the post to try and enter another code, the actual comment data will have to be entered again. Name, email, and URL don’t have to because they are stored in a cookie on the client. Perhaps I will add that at a later time.