Prevent Spam on PunBB

One of the main problems with PunBB is that its very prone to spam. While there are some plugins out there that deal with this, I prefer to use my own little hacks instead.

Open up post.php and find some code that looks like this:

// Validate BBCode syntax
if ($pun_config['p_message_bbcode'] == '1' && strpos($message, '[') !== false && strpos($message, ']') !== false)
{
require PUN_ROOT.'include/parser.php';
$message = preparse_bbcode($message, $errors);
}


Below that code add the following


if ($pun_user['is_guest'])
{
$temp_message = strtolower($message);//lowercase it so we can be case insensitive, stripos is php5 only
if ((strpos($temp_message, 'http://') !== false) || (strpos($temp_message, 'https://') !== false) || (strpos($temp_message, '[url') !== false) || (strpos($temp_message, '[img]') !== false) || (strpos($temp_message, '[email') !== false) || (strpos($temp_message, 'www.') !== false) || (strpos($temp_message, '@') !== false))
$errors[] = $lang_post['Guest spam protection'];
}
else if ($pun_user['num_posts'] < = 5)
{
$temp_message = strtolower($message);//lowercase it so we can be case insensitive, stripos is php5 only
if ((strpos($temp_message, 'http://') !== false) || (strpos($temp_message, 'https://') !== false) || (strpos($temp_message, '[url') !== false) || (strpos($temp_message, '[img]') !== false) || (strpos($temp_message, '[email') !== false) || (strpos($temp_message, 'www.') !== false) || (strpos($temp_message, '@') !== false))
$errors[] = $lang_post['New Member spam protection'];
}


If you allow guests to post it will look to see if they are posting a link, image or a email address. It might seem like double work to test for http:// and [url but a lot of spam bots are stupid and will attempt to put bbcode on blogs, email forms and all over the web. I've found sometimes they wont even put the http:// but put in the bbcode [url]. Don’t ask me why, but thats how some spam bots were programmed and so you might as well filter them all. Its a good idea to filter for the @, I’ve gotten some spam where a bot put up a work at home post and had their email address for a contact. Sometimes they will just try to put in www. hoping the forum will pick it up and turn it into a link. You might also add a test for some TLDs (top-level domains, such as .com, .net, .org), incase they leave off all the prefixes. I’ve yet to see bots do that, but I’m sure they probably will, good thing is, that its a easy addition.

If you don’t allow guests don’t worry, this code will still work. The code also tests for registered users and sees if they have more than five posts (feel free to increase or decrease that amount) and if so they will be allowed to post links, images and email addresses. Most bots out there sign up once and spam the message board one time. And later on they will re-register and put up another post, I’ve yet to see any spam bots use the same login to spam some more.

Open up \lang\English\post.php and after

'Edit redirect' => 'Post updated. Redirecting . . .'


Add a comma at the end of that line and then add


'New Member spam protection' => 'New Members can not post links, images or email addresses until they become more active.',
'Guest spam protection' => 'Guests can not post links, images or email addresses.'


You will want to add the spam protection to edit.php also, so open that up and after


// Validate BBCode syntax
if ($pun_config['p_message_bbcode'] == '1' && strpos($message, '[') !== false && strpos($message, ']') !== false)
{
require PUN_ROOT.'include/parser.php';
$message = preparse_bbcode($message, $errors);
}


Add the following (its pretty much the same as the post.php uses except there is no test for guests since guests can’t edit posts anyway).


if ($pun_user['num_posts'] < = 5)
{
$temp_message = strtolower($message);//lowercase it so we can be case insensitive, stripos is php5 only
if ((strpos($temp_message, 'http://') !== false) || (strpos($temp_message, 'https://') !== false) || (strpos($temp_message, '[url') !== false) || (strpos($temp_message, '[img]') !== false) || (strpos($temp_message, '[email') !== false) || (strpos($temp_message, 'www.') !== false) || (strpos($temp_message, '@') !== false))
$errors[] = $lang_post['New Member spam protection'];
}


And now you have spam control. Granted its a hack and not a plugin, it works pretty good.

Tags: code, spam

This entry was posted on Monday, May 7th, 2007 at 8:01 pm and is filed under PunBB. You can follow any comments to this entry through the RSS 2.0 feed. You can skip to the end and leave a comment. Pinging is currently not allowed.