Category: ASP

Hands up who thinks “captcha”, an image based challenge-response test to ensure a response is not generated by a computer, is a big pain in the butt and you’re sick and tired of seeing it in every web form. Not only is it obstructive but most of the images are very difficult to decipher.

Well, an alternative to “captcha” is a well place hidden variable within a web form containing a random number. It doesn’t require user intervention so it’s seamless which would mean that your customers are less annoyed. It acts like a simple redundancy check which effectively identifies if the web form was submitted from the server, and not remotely invoked through a “page scrape” copy. If the web form was submitted from a remote copy, which is how most “robot” processes operate, then the form is not processed.

The example form below is a simple “contact us” page and it implements the hidden variable redundancy check. Make sure that you insert your own code in the following comment block:

'**************************************************************************************
'* Insert code here to post the message
'* Eg. Insert message in a database or send message to your email address
'**************************************************************************************

Save the following code as contact.asp:

<%
  '**************************************************************************************
  '* Store the FORM PASSWORD session value in MESSAGE_PASSWORD variable
  '**************************************************************************************
  MESSAGE_PASSWORD = Session("FORM_PASSWORD")

  v_error = ""
  if Request("posted") = 1 then
    name = Request("name")
    email = Request("email")
    message = Request("message")

    ' Validate web form values
    if name = "" then
      v_error = v_error & "Please enter your name<br />"
    end if
    if validateEmail(email) = false then
      v_error = v_error & "Please enter a valid email address<br />"
    end if
    if message = "" then
      v_error = v_error & "Please enter your message<br />"
    end if

    if v_error = "" then

      if CInt(Request(MESSAGE_PASSWORD)) = CInt(MESSAGE_PASSWORD) then
        '**************************************************************************************
        '* Insert code here to post the message
        '* Eg. Insert message in a database or send message to your email address
        '**************************************************************************************

        Response.write "Your message was sent to us successfully. We will respond to you within 24 hours of receiving this message."
        message = ""
      end if
    end if
  else
    '**************************************************************************************
    '* Generate new FORM PASSWORD value and store it in session variable
    '**************************************************************************************
    Session("FORM_PASSWORD") = randomNumber
    MESSAGE_PASSWORD = Session("FORM_PASSWORD")
  end if
%>
<h1>Contact Us</h1>
<p>Please enter your query in the message text area below</p>
<%
if v_error <> "" then
  Response.write v_error
end if
%>
<form action="contact.asp" method="post">
<table border="0" cellpadding="0" cellspacing="2">
  <tr>
    <td class="tdhead">name</td>
    <td class="spacer" />
    <td><input name="name" id="namefield" class="textbox" type="text" size="38" maxlength="50" value="<%= name %>" /></td>
  </tr>
  <tr>
    <td class="tdhead">email</td>
    <td class="spacer" />
    <td><input name="email" class="textbox" type="text" size="38" maxlength="50" value="<%= email %>" /></td>
  </tr>
  <tr>
    <td class="tdhead">message</td>
    <td class="spacer" />
    <td><textarea name="message" rows="5" cols="40" class="textbox"></textarea></td>
  </tr>
  <tr>
    <td colspan="2" />
    <td>
      <input type="hidden" name="posted" value="1" />
      <input type="hidden" name="<%= MESSAGE_PASSWORD %>" value="<%= MESSAGE_PASSWORD %>" />
      <input type="submit" value="Send Email" class="textbox2"  />
    </td>
  </tr>
</table>
</form>
<script type="text/javascript">
  if (document.forms.length > 0)
    if (document.forms[0].elements.length > 0)
      document.forms[0].elements[0].focus();
//-->
</script>

<%
'**************************************************************************************
'* Common functions
'**************************************************************************************

'**************************************************************************************
'* validateEmail
'* -------------------------------
'* Returns true if email is well formed, false otherwise
'**************************************************************************************
Function validateEmail(sCheckEmail)
  Dim sEmail, nAtLoc
  validateEmail = True
  sEmail = Trim(sCheckEmail)
  nAtLoc = InStr(1, sEmail, "@") 'Location of "@"

  If Not (nAtLoc > 1 And (InStrRev(sEmail, ".") > nAtLoc + 1)) Then
    '"@" must exist, and last "." in string must follow the "@"
    validateEmail = False
  ElseIf InStr(nAtLoc + 1, sEmail, "@") > nAtLoc Then
    'String can't have more than one "@"
    validateEmail = False
  ElseIf Mid(sEmail, nAtLoc + 1, 1) = "." Then
    'String can't have "." immediately following "@"
    validateEmail = False
  ElseIf InStr(1, Right(sEmail, 2), ".") > 0 Then
    'String must have at least a two-character top-level domain.
    validateEmail = False
  End If
End Function

'**************************************************************************************
'* randomNumber
'* -------------------------------
'* Generate random number
'**************************************************************************************
Function randomNumber
  Randomize timer
  Dim rndNum
  ' Randomizing the timer function
  rndNum = abs(int((rnd() * 3001)))
  ' To generate a prime based, non-negative random number..
  rndNum = rndNum + 53
  randomNumber = rndNum
End Function
%>

Some comments about the code:

When the form is first requested it generates a random number which acts like a form password.

    '**************************************************************************************
    '* Generate new FORM PASSWORD value and store it in session variable
    '**************************************************************************************
    Session("FORM_PASSWORD") = randomNumber
    MESSAGE_PASSWORD = Session("FORM_PASSWORD")

This password is stored in a session variable as well as in the form as a hidden item with the same name and value, being the password itself.

  '**************************************************************************************
  '* Store the FORM PASSWORD session value in MESSAGE_PASSWORD variable
  '**************************************************************************************
  MESSAGE_PASSWORD = Session("FORM_PASSWORD")

      <input type="hidden" name="<%= MESSAGE_PASSWORD %>" value="<%= MESSAGE_PASSWORD %>" />
 

When the form is submitted the session value and form value is compared, and if they match then the form is processed.

      if CInt(Request(MESSAGE_PASSWORD)) = CInt(MESSAGE_PASSWORD) then
        '**************************************************************************************
        '* Insert code here to post the message
        '* Eg. Insert message in a database or send message to your email address 
        '**************************************************************************************

        Response.write "Your message was sent to us successfully. We will respond to you within 24 hours of receiving this message."
        message = ""
      end if

That’s it! Happy coding!