Guestbooks: Protecting
Email Addresses

 

Richard H. Nilsson, May 15, 2003

Abstract

Malicious email-miners can use easily obtained tools to collect exposed email addresses your visitors leave in your guestbook. The purposes of a guestbook are usually to permit site visitors to leave comments and provide a means of establishing contact with others of like mind or belonging to the same group to establish a line of communication. Usually this is accomplished by the visitor leaving his/er email address. Not only can you readily detect and divert known miner programs, you can also hide your visitor's addresses and still allow visitors to send messages to each other. Solutions for both techniques are given. Requires knowledge of, and availability of PHP/MySQL services on your host ISP's server.

 


The problem

One problem with unrestricted, unlicensed, universal access to a world-wide data network is that malicious infants or unscrupulous spammers can surreptitiously mine your pages for email addresses. You owe it to your visitors to take any action you can to protect the information they volunteer, including their email addresses. In the old days, if you staked a legal claim to your mine, others had to leave it alone or eventually face a magistrate and the consequences of trespass. Not so with the Web. For the small-site owner, retribution is virtually unattainable.

How do miners get your addresses? Very simply, they acquire one of several dozen readily available 'robot' applications and use them to scan your site. These applications typically have some intelligence built in for spotting obvious attempts at hiding addresses. For example the (very) old ploy of putting "nospam" in your address, or similarly changing the "@"-sign to "at", "(at)", or "(a)" is no longer effective.

Another, more incidious exploit is to inject "extra" addresses into the "to" field of PHP email scripts.

What can you do? Actually there three steps you can take: First, you can detect and deflect many of these known 'bots' as soon as they attempt to access your guestbook. Second, you can hide your visitors addresses so they can't be mined even if the bot slips in to view the guestbook. Third, you can script in ways that prevent PHP injection.


Deflecting Known Bots

How do you detect a bot intrusion?

For just a guestbook, it's not totally necessary to do this, so I'm not going to go into the details here, but I will give you a link to a solution. Please see what my friend Loran did to protect his entire site. I just applied his techniques to my guestbook page.


'Enkode' Your Addresses

The folks at Automatic(formerly Hiveware) have graciously provided an on-line form which encodes your address, phone number or any other text into a block of JavaScript that the email miners are as yet unable and unlikely to break. If you only have a few addresses to protect, this is an easy solution. I use this technique for the odd time I just want to give an "email me" link in an obvious place. I save the "Enkoder"-generated code in a file called "myenkodedaddr.js" in an includes directory and then insert this code where the address link should go:

<script type="text/javascript" src="includes/myenkodedaddr.js"></script>

In addition, your ISP may allow you to protect the includes directory using .htaccess or some other method that doesn't interfere with the Web serving of your pages, but prevents someone from finding out how your address is "enkoded".

Database Your Guestbook

The best way to hide your guestbook visitors addresses is to store them in a database. These days, most ISPs provide free access to your own MySQL database for the basic monthly rate. If yours doesn't, consider switching.

Find a good PHP/MySQL tutorial using Google and set up a database for your visitor entries. There are plenty of tips around for displaying 10 or 20 entries at a time, and browsing large databases. Here is a PHP tutorial telling all you need to know to set up a MySQL "db" on a LAMP-technology host (Linux_Apache_MySQL_PHP). Many more are available on the web; do a Google-search with keywords "php tutorial mysql".

Create a database containing a table of visitor's information; for the example, I called the table "Messages", because that's what it contains. In your table structure, provide fields for at least message id (make this the unique id), timestamp, first name, last name, email address, and a message. Here's an example MySQL database table creation command, that sets those up and has a few additional fields:

CREATE TABLE Messages (
  Entryid int(5) NOT NULL auto_increment,
  Time varchar(8) NOT NULL default '',
  Date varchar(10) NOT NULL default '',
  Fname varchar(20) default NULL,
  Lname varchar(20) default NULL,
  Email varchar(40) default NULL,
  URL varchar(80) default NULL,
  City varchar(30) default NULL,
  State varchar(30) default NULL,
  Country varchar(20) default NULL,
  Comments text,
  PRIMARY KEY  (Entryid),
  UNIQUE KEY id (Entryid)
) TYPE=MyISAM;

Fields of a visitor's message (one row from the table) are fetched from the database via a PHP API (Application Programing Interface) "query" statement into an array arbitrarily called "$myrow". (You can see examples of these statements in the section "Provide A Mailer", below.) Elements of the array are displayed by printing "$myrow['FieldName']" where "FieldName" is one of the names of the fields in each record, for example the unique record ID, "Entryid". Where you would normally show the visitor's email address as a link that brings up the browser's email client for generating a message, use something like this code instead:

printf(" &lt;<a href=\"mailform.php?thisid=%s\" target=\"_blank\">Send a message</a>&gt;", $myrow["Entryid"]);

All the browser or the bot sees is an inoccuous link saying "Send a message". Clicking the link, however, opens a new window ('target=\"_blank\"') and fills it with the file "mailform.php" (a file you must create) and passes it the 'Entryid' of the record containing the recipient's address ('href=\"mailform.php?thisid=%s\"'). The "%s" gets the value "$myrow['Entryid']" given later in the code line. This page is basically an email message form. It is important that you do not display the recipient's email address in the page. In the example email form I link to below, notice that only the recipient's name is shown. Neither the browser nor a link-following bot can see the address, because it stays on the server as a PHP variable value.


Provide a Mailer

Now that you've hidden your visitors' information invisibly entrenched in a database, you need to provide an alternative means for your visitors to open private communications channels which they can continue on their own. I did this on one site by creating a PHP-enhanced mailer form. Download a copy from the link below and open it in an editor to read along while I discuss some of it's features:

Example numbered 'emailform.php'

The example mailform has some interesting features. It provides a form for entering a message much like popular email clients, it does some verification of message contents, and uses a built-in PHP function to send the message through your ISP's mail server. Follow along while I describe the code line-by-line:

Description of 'emailform.php':
1-4: Standard HTML beginning and title.
7-10: A function that initializes the cursor to the first form blank, for convenience. Eliminates the need to click somewhere on opening the form.
11-33: Form verification function called by the "ACTION" attribute of the FORM tag later in the page. All blanks are required. The user must enter a *valid* "from" email address twice for it to be accepted.
43-76: A CSS stylesheet to control text appearance and provide some basic page structure.
78: The body tag calls the focus function referenced above, after the page loads.
79: Creates the main block of the page content. Its position, size and other attributes are controlled by the CSS rule "#maincontent" in the HEAD stylesheet.
81-133: The main block of PHP code.
83-98: Code that logs in to our database in preparation for extracting names and email addresses.
101-117: When the form is submitted and successfully verified by the JavaScript verify() code in the page head, this code submits the contents as a mail message. An error message is displayed if there is a problem sending. In either case, it provides a button to close the window containing the form.
122-131: If the form was NOT submitted, we prepare to display the form by querying the database for the name and email address of the author of the message we used to call this page. The message ID is passed to the page in the variable arbitrarily named "$entryid".
131: Here we fetch the desired info into the array "$myrow". If we get no data, or more than one record (not likely) we show an error.
134-165: This standard HTML displays the message input form. In the first line we set the form action to re-load the page. But first, the form is routed to our JavaScript verifier by the "onSubmit" handler when the "Send" button is clicked. Verified form inputs are passed to the page code under variables of the same name; e.g., form input element "name='to'" becomes variable "$to". Re-loading doesn't occur until the form contents passes the criteria in the JavaScript function in the page HEAD.
138: Here we display the message author's first and last name- But not his email address!.
139: Here the recipient's email address is stuffed into a "hidden" form element. Email miner software only gets the rendered page, so since this is a hidden field, it will not be seen.
159: The form's "Send" button submits the form to the JavaScript verifier called out in line #130.
171-174: A neat little JavaScript to shrink the form popup window to a smaller size after it loads.

Here's an un-numbered version you can download and use as-is:

Example 'mailform.php'

To use this mailform, make any appropriate changes to match your database setup, site style, color schemes, and save the page as "mailform.php" or some other name ".php" as desired.


Figure 1: Message form in the browser

form on screen

Summing up

The Web can be a dangerous place, and you owe it to yourself and your site visitors to protect anonymity. The steps shown here can make any emails your visitors leave with you invisible to spammer email-miners. The sooner you implement protection, the better. Our experience has shown that spammers regularly update their lists, so the sooner you hide your email addresses, the sooner they will disappear from unwanted mailing lists.

Copyright 2004 Richard Nilsson. Verbatim copying and redistribution of this entire article are permitted without royalty in any medium provided this notice is preserved.