#24643 [Csd]: email address gets published on www unobfusciated

ID: 24643 User updated by: jelte dot werkhoven at itfy dot com Reported By: jelte dot werkhoven at itfy dot com Status: Closed Bug Type: Website problem Operating System: irrelevant PHP Version: Irrelevant Assigned To: goba New Comment: I know it was reported earlier, but I'll take any chance to compliment you guys on your great work =) Previous Comments: ------------------------------------------------------------------------ [2003-07-14 11:22:18] davey@php.net I'd like to quickly note what I use to combat spambots, its simply htmlentity'ing every character in the link, including the mailto: part. Browsers understand this without a problem, but spambots don't seem to have worked this one out yet. I've tested this code in IE6 with and without SP1, Mozilla 1.2.1, 1.3, 1.3.1 and 1.4 and Opera 7. function obfuscate_email($email) { $email_obfuscated = '&#109;&#97;&#105;&#108;&#116;&#111;&#58;'; /* this is the HTML entitys for mailto: */ $email_length = strlen($email); for($i=0; $i < $email_length; $i++) { $email_obfuscated .= '&#' .ord($email{$i}) . ';'; } return $email_obfuscated; } echo '<a href="' .obfuscate_email('davey@php.net'). '">E-Mail Me!</a>'; You can see the result and test for yourself at: http://pixelated-dreams.com/~davey/test/obfuscate_email.php - Davey ------------------------------------------------------------------------ [2003-07-14 04:08:16] derick@php.net Heh, if that's what you think: great ;-) But actually it was reported before already... ------------------------------------------------------------------------ [2003-07-14 04:06:18] jelte dot werkhoven at itfy dot com Thanks guys for your rediculously quick action on this bug. I timed you at a little over twenty minutes from my submission to your solution. Kudos! And yes, I quite alright with having my email adres in manpages. ------------------------------------------------------------------------ [2003-07-14 03:57:44] goba@php.net By the way, we have a blocking statement for robots in our robots.txt to prevent them form indexing our backend data. This does not work for that mirror you found the data on, as the rule says /backend/.... ------------------------------------------------------------------------ [2003-07-14 03:54:17] goba@php.net I have just fixed the code to make obfuscation work on the server where those data files are generated. I have not employed base64 encoding as all the data will go out as plain text anyway on the manual pages, so the obfuscated versions can be collected from the manpages too. Therefore there is no point to base64 code that part in the communication, as that is not the "weakest part" of the email address transportation and display chain. As the original reporter had no problem with the obfuscated version available from the manpages, I hope he will have no problem with this solution. ------------------------------------------------------------------------ The remainder of the comments for this report are too long. To view the rest of the comments, please view the bug report online at http://bugs.php.net/24643 -- Edit this bug report at http://bugs.php.net/?id=24643&edit=1