The World of Stuff .com

Eureka! Quesca!

I finally finished tinkering with the blog after upgrading to the new version of WordPress, version 1.5.

Before (and, for what it’s worth, after) the upgrade I had been receiving some comment spam. I thought about downloading a plugin for WordPress that would generate a CAPTCHA test (you know, one of those images with a number or code that you have to retype so they know you’re a human and not a computer) that a user would have to pass for their comment to appear. And I was going to, too, were it not for:

1. WordPress 1.5′s seemingly okay controls over comment spam, and
2. A fabulous idea I hit upon while editing these files to make the blog layout smooth again.

I was editing the comments form so that the name and comment fields would be required, but not the e-mail or URL fields. I assumed that one of the magnets in a blog that draws comment spam (besides bloglike keywords) is the presence of a form with input boxes called “name,” “email,” etc. Would spamming scripts know what to do with a field that, in the internal workings of the page, is referred to as “heyMyNameIsDave”?

So, I thought, a CAPTCHA script tells a human and a computer apart by generating a random number (or word, or mish-mash of letters and numbers) and encode it in an image so that a program theoretically can’t read it. But would a program designed to spam be able to answer a simple question? For example, “What is two plus two?” Well, yes, they could be programmed to recognize such simple questions, but why would they?

So, the easiest and most obvious way of keeping comment spam from reaching me is to pose a question that anyone can answer. (I’ll probably use “What is two plus two?”) Make it a required field, just like the name and the comment, so when the form is submitted, the script will check to make sure the value of heyMyNameIsDave is 4. If not, then the script dies and outputs a simple message to go back and answer the question.

This has the advantages of a CAPTCHA (not likely to be read by computers; easily answered by humans) without the disadvantages (large, slow scripts; incompatibility with blind or visually impaired users who use a screen reader).

Even though I’m sure someone has thought of this before, I shall christen it myself. I’ll call it… quesca (question spam programs can’t answer). Well, we’ll see about that as soon as I put a quesca in the comment form.

[Edit -- Mar 21, 2005 21:43 EST: I thought it would be a good idea to include here the code I used to make this highly effective method possible. So, copied directly from a later post, here it is.

First, add this to your /wordpress/wp-content/themes/[name of theme]/comments.php file after the comments textarea:

<p>2 + 2 = <input type="text" name="heyMyNameIsDave" size="1" maxlength="1" />
<span style="font-size: 8.5pt">(Enter the correct answer. This is a simple <a href="/archives/2005/02/23/eureka-quesca/">quesca</a> test to make sure you're a human being and not a spamming robot.)</span></p>

Now go to /wordpress/wp-comments-post.php. Right under these lines:

$comment_author = $_POST['author'];
$comment_author_email = $_POST['email'];
$comment_author_url = $_POST['url'];
$comment_content = $_POST['comment'];

add this line:

$heyMyNameIsDave = $_POST['heyMyNameIsDave'];

And after these lines:

if ( get_settings('require_name_email') && ('' == $comment_author_email || '' == $comment_author) )
die( __('Error: please fill the required fields (name, email).') );

add these:

if ('4' != $heyMyNameIsDave)
die( __('Error: please enter answer the question after the comment field correctly.') );

If you know how the code works, it should be pretty easy to configure it to your liking. All it does is create another field and doesn’t post the comment if the field doesn’t have the correct value.]

Make your own tiny pixel font online! I haven’t really tried it yet, but it looks cool.