Defending Stand-Alone Profile Forms from Spam

[Denver Dave]

I'm testing CiviCRM version 3.1 stand-alone forms.  I take it that stand-alone forms don't use captcha without modification and I'm not necessarily a fan of captcha anyway.  However, I know from past experience, that a form left undefended will start to attract spam.  Because the stand-alone form adds records to the database, this could be bad. 

How are others defending their stand-alone forms against form spam?

Thanks.

[Denver Dave]

A little more on defending.  Seems like most approaches involve adding something to the form that detects a "human" and the something is evaluated by the form processing program.  Even with stand-alone forms, we could add our own captcha processing, add additional fields (what's 3 + 4) or I've had fairly good luck detecting if JavaScript is enabled.  

form action="http://<mydomain>/drupal/index.php?q=civicrm/profile/create&amp;gid=<group #>&amp;reset=1"
Sorry, so for over several versions, I continue to be clueless to where to find the code corresponding to the URL  - Tip ?

Thanks, Dave

[Dave Greenberg]

Dave - Code which builds the Profile create and / or edit forms is in:

CRM/Profile/Form/Form.php - buildQuickForm function.

[Piotr Szotkowski]

A little more on defending.  Seems like most approaches involve adding something to the form that detects a "human" and the something is evaluated by the form processing program.  Even with stand-alone forms, we could add our own captcha processing, add additional fields (what's 3 + 4) or I've had fairly good luck detecting if JavaScript is enabled.

If you’re going with CAPTCHA anyway, you can use ReCAPTCHA.

Alternatively, a simple anti-spam measure (much friendlier to people) is to add a hidden field (or hide an input/textarea field via CSS) and require it to be empty – humans won’t see it, but spam robots often fill in all the fields they encounter.

[Dave Greenberg]

Similar tools - CiviCRM uses reCaptcha for it's forms. You can google the projects if u need more info.

[Denver Dave]

The reCaptcha also effective keeps people out.  I personally find them very hard to read.