16
OCT
2007
I was referred to check out this article Preventing spam without using a CAPTCHA and it reminded me that I too had created an alternative method of preventing spam robots from signing up on my sites.
I found that sometimes the CAPTCHA failed and that there had to be another way to prove that someone is human. I imagine that the bot writers are constantly updating their algorithms for screen readers to try to read CAPTCHAs, or they are finding ways to crack the popular CAPTCHAs. I don’t doubt that this method would be pursued in the same fashion.
ConfirmHuman takes a very simple approach. The idea is: mimic something that only a human can do (for now). Some of these actions are clicking, dragging, scrolling. Something that is easy for a human to do, but slightly more complex for a bot to do, yet keeping the process simple enough that it won’t frustrate or divert users.
Installing ConfirmHuman
There are three steps involved in installing ConfirmHuman:
Step 1: Include the code
Include confirmhuman.js and confirmhuman.css on the page you want to use it.
Step 2: Modify the form
Give your form the name attribute of “cc” and then in your form somewhere, add this code:
<div id=”confirm_box”>
<div id=”confirm_click_box” style=”display:none” onclick=”cc.addClick()”><p>click here</p></div>
</div>
Step 3: The backend
Now, when someone posts the form, check for a POST variable named click_confirm and make sure its value is “done”.
In the future, if people like this idea, I may make it more customizable so you can pass in the name of the form and the id of your confirm box. For now, this method is simple and everything is done for you, so you lose a little bit of the customization.
Buy me a beer if you liked this post or found it helpful









October 16th, 2007 at 5:59 pm
Slightly curious, but is onclick universally accepted by browsers as the same as enter or space when focused on the submit button? Not all of us have time to drag the mouse over to a button and click it you know…
October 17th, 2007 at 3:45 am
I don’t see how this is any different than simply submitting the form using JavaScript (keeping the action out of the HTML of course). If you do that, you don’t even need a Captcha. However, the Captcha method is more bulletproof since with the JS method it’s still possible to submit directly to the script with the correct post info. This method would only work if it was distributed on a smaller scale. Larger scale distributions would fail because the method and its workaround would certainly be accounted for and circumvented.
October 17th, 2007 at 11:19 am
@BlackZilla:
You make a good point. I am going to modify my script so that it doesn’t submit ‘done’, but a randomly generated string stored in the session which will be matched in the controller.
October 17th, 2007 at 4:39 pm
But if the string is transmitted as part of the page, the bot can pick it up. That’s where the Captcha is better. The string is never sent to the browser, except as an encoded in the image, which is unreadable by a computer.