Stop Using Email Addresses for Validation

I still see a lot of forms require email address to post comments or for simple verification. It doesn’t stop spam at all.

You should only ask for a person’s email address if:

  • You require registration to access part of the site.
  • They have a password and will need to be able to reset it.
  • You will have an option to notify them of new comments or a response to their comment.
  • It’s an email form (then you need it, because how else will you respond).
  • It’s for a newsletter.
  • It’s an online purchase.

I’m probably forgetting a few other instances where its needed, but I think you get the idea. Using a email address to send a user a link to click on to verify it is inconvenient as well. You might as well just have them register and send them a initial verification link.

I understand spam is out of hand, but I’ve written an email form awhile back that gets very little.

Here are some things I do to prevent spam:

  • Filter HTML.
  • Filter any unsafe characters.
  • Prevent blank fields not only with JavaScript but on server side also.
  • Check field lengths not only with JavaScript but on server side also, don’t let them try to send a longer text than what your form is set to, this should be a red flag that they are trying to do something fishy. You can trim whitespace characters with JavaScript.
  • Look for any attempts of e-mail injection. Often times spammers try to trick your email form to spam others by putting in CC:, Content-Type:, To: and so on.
  • If its a email form and the email address is required, make sure the email address is in a valid syntax. Also make sure the domain part of the email address is one that really exists (PHP can do this).
  • Check the email address thats supposedly sending it and see if it is on my ban list.
  • Check the ip address thats supposedly sending it and see if it is on my ban list.
  • Check the words in the title and subject and see if they are on my censor list. Censored words will be let through but will be filled with asterisks.
  • Check the words in the title and subject and see if they are on my ban list. Bots are dumb and sometimes will send UBB code like [url=]my nasty site[/url] because they thought the form was part of a forum. Just makes it easier for me to filter.
  • I like to filter out @ with (a) and replace any http://, https://, http://www. or https://www. with LINK: because often email clients will render these as links and I don’t want to accidentally click on them.
  • Count how many links are being sent and compare it to my limit. Some spam bots go insane and try to send 50 links per email.
  • Compare what domain the form was referred from with my allowed list, helps prevent cross-site scripting. For example, if your form on sends data to, it should only allow and to do that. You could add more subdomains if you want to. I’ve seen server logs coming form some pretty nasty sites and the pages with forms get the most hits, so I know what they are doing.
  • Check the token, helps prevent cross-site scripting. Chris Shiflett has a good tutorial on this. It’s in PHP but you can use the principles for any language.
  • I usually ban the emails from the domain the form is on. For example, if your domain is, a lot of bots will simply just fill out the email form as because they assume you would never ban your own domain.
  • Check the timestamp, any forms that are older than X minutes wont be sent.
  • See if the same email address or IP address sent an email recently (flood protection).

I also log things at the end of my email, so I can monitor what is going on, incase I get a spammer that is getting through. Often I can see what pattern they follow, such as using the same IP address, email address, words, etc. and I can modify my filters accordingly.


Leave a Comment

Comments are reviewed before publishing to prevent spam.