I was working on my site today and I noticed that stupid spam bots got around my cheap little addition script. If you go to http://rodserna.com and hit a comment link next to one of the blog titles you will see what I mean. If someone could give me their opinions on the easiest way to get rid of these I would much appreciate it.

Well, some more complex math for starters, and maybe something like, "Please type the sum of seven and twelve with the digits reversed".

I am going to try using the sum, but I know people too stupid to know what reversing digits is so I assume OTHER people are also too stupid.

BTW, I think that I am going to have to delete that spam message.

Aye, you might as well. More generally, the trick is to come up with a task as trivial as possible for human users and as complex as possible for automated users.

an excellent example being the registration page of Cemetech

You mean like the letter/number verification, or the street signs? I definitely do not want to use street signs. Just too much.

I had an idea that was very similar to Kerm's "Please type the sum of seven and twelve with the digits reversed".

"Type the third, 4th, 5th, and seventh number in this series seperated by spaces: RAND_INT, RAND_INT, RAND_INT, RAND_INT, RAND_INT, RAND_INT, RAND_INT, RAND_INT."

I was also thinking something like "Ignore the second and third digits, and add the first and last digits in this series: RAND_INT, RAND_INT, RAND_INT, RAND_INT."

Or a mixture of the two.

Picking a couple numbers out of a series and doing something with them can be easily done by a human. Something like that would be good if you had an array containing different statement "templates", so its the same question every time but it is worded differently and contains different numbers.

That sounds like it might be too complex for some users. I'd recommend simplifying it a hair without making it too much weaker, maybe something along the lines of, "Please enter the sum of the first and third digits of this number: 2945".

or, yeah, I meant the street signs, but that system is configurable to use any images at all.

I have read one article where a person used CSS to hide another text input box and give it a meaningful name. Then, in PHP, you check the status of the text box to verify the person (bot/person). Most bots are written so that they fill out every part of the form, even if they don't know what it is for. By hiding the box, a user shouldn't be able to fill it in (unless they have CSS disabled or something). He claims that is has stopped bots from spamming his site, and does not interfere with users in any way. If I dig up the link, I will post it.

Very interesting. That might be a good idea

Heres an idea: Make a captcha but if the associated text box has value then don't let them through. Give a notice to the user under the captcha not to enter any value, but keep it there. This way an automated user will treat it like a normal captcha and fill in the field.

My only problem with that idea is that it would be kind of pointless to have a captcha that just sits there. But you could make it pretty simple with just a white background and some characters.

You could also do a mixture of a captcha and Kerm's variation of my idea; Have the image contain at least two numbers and tell the user to add those numbers up. If you do it a certain way it might not be too complicated for some users, but its an idea

I like the idea of the invisible text box. Maybe I will give that a try.

Ah yes, I've heard of that approach being used with good success before. Use CSS to hide it, though, not <input type="hidden">, as the bots will notice that.

I'm going to give this a try on my projects as well. Its a lot cleaner

Excellent, please let us know how it goes. Does it really stop most spammers, or does it let through a substantial number of them?

Meh, that approach sucked. It stopped SOME spambots, but there are still plenty coming through. I really need to get around to fixing this.

Meh, disappointing. I'd say combine a few of the methods we've discussed, then, and see what happens.