I Have Resorted To Checking Comment Content (For Spam)

Posted November 28, 2006 at 9:08 AM

It seems I have taken one step forward, two steps back when it comes to blocking blog comment spamming. Stuff just keeps getting through. Granted, I have not implements some of the ideas that I wanted to rip from Dinowitz, but it bugs me none the less. I have finally resorted to actually checking the content of the comment. Right now, I am not allowing anyone to post link tags <A>. Ugggg. This shouldn't be an issue for the most part as most people don't post link tags to my blog (other than spammers). Hopefully this is only temporary before I can find a better solution.

Post Comment  |  Ask Ben  |  Permalink  |  Print Page




Learning ColdFusion 9 - ColdFusion 9 tutorials, samples, examples, demos

Reader Comments

Rick O
Nov 28, 2006 at 11:55 AM // reply »
153 Comments
277 Points

Not that you need one more thing to do, but if you want a bulletproof comment spam solution you may consider porting SpamKarma to your blog system. It uses an entire system of weights and measures to make a best-guess to determine of a comment is spam or not. In the year that I've been using it, only 3 comment spams have gotten through, and that was only in the hour or so I had it turned off to upgrade my copy of WordPress. (And I believe the identity id in my comments table is up to 4000+, even though I only have ~100 approved comments on my entire blog, if that shows you how good it is.)

http://unknowngenius.com/blog/wordpress/spam-karma/

It's really the one thing that keeps me from running BlogCFC on my site. If BlogCFC had SpamKarma, I'd upgrade in a heartbeat.

-R


Ben Nadel
Nov 28, 2006 at 11:57 AM // reply »
6,515 Comments
25,754 Points

Rick,

Thanks, I will check it out. Thanks for the link.


Post Comment  |  Ask Ben

Recent Blog Comments
Darren
Nov 20, 2009 at 5:38 PM
Learning ColdFusion 8: CFImage Part I - Reading And Writing Images
Hi Ben, Great article. I've been looking around to see if ColdFusion image engine can programatically create the following "wrap around" effect: http://www.creativepro.com/article/photoshop-s-she ... read »
Todd Rafferty
Nov 20, 2009 at 5:35 PM
Maintaining ColdFusion Sessions Across SMS Text Message Requests Without Cookies
@Dave: I talked to Gert he suggested: <cfhttp method="get" url="http://{some cf website}" result="stuff" addtoken="yes" /> Note the addition of cfhttp attribute addtoken. That should persist y ... read »
Ben Nadel
Nov 20, 2009 at 5:23 PM
Maintaining ColdFusion Sessions Across SMS Text Message Requests Without Cookies
@Todd, Ahh, gotcha, yeah that makes sense. ... read »
Todd Rafferty
Nov 20, 2009 at 5:17 PM
Maintaining ColdFusion Sessions Across SMS Text Message Requests Without Cookies
Ben, sorry if I didn't make this clear. You can make it work like that if you want, just put <cfset session.foo = 1> (and <cfset application.foo = 1>) in your OnRequestStart() and it reve ... read »
Ben Nadel
Nov 20, 2009 at 5:07 PM
Maintaining ColdFusion Sessions Across SMS Text Message Requests Without Cookies
@Todd, I have seen tidbits about the way Railo handles session. I can understand that it lazy-loads sessions, but I also think that I might make some things more complicated. For example, often tim ... read »
Todd Rafferty
Nov 20, 2009 at 4:53 PM
Maintaining ColdFusion Sessions Across SMS Text Message Requests Without Cookies
Ben, you can ramp up the security by turning on J2EE session which gives you a third set of numbers other than CFID/CFTOKEN. There's a reason why ACF put this in place (other than just session replic ... read »
Todd Rafferty
Nov 20, 2009 at 4:52 PM
Maintaining ColdFusion Sessions Across SMS Text Message Requests Without Cookies
Case in point, Ben, you may not be aware of this, but in Railo - OnApplicationStart() & OnSessionStart() act differently than in ACF. ACF does: OnApplicationStart (1st hit) OnSessionStart (1st and e ... read »
Ben Nadel
Nov 20, 2009 at 4:46 PM
Maintaining ColdFusion Sessions Across SMS Text Message Requests Without Cookies
@Todd, That's understandable. I am not sure if this really leaves any more security holes than the fact that using old cookie-based CFID / CFTOKEN values will create a new session using the old CFI ... read »