Advanced anti-spam measures for PHP contact form - contact-form

Question

Receiving confusing spam that shouldn't be possible with the anti-spam and form requirements I have in place, so I need help determining how to attack this particular bot.
I have a simple contact me form on my website that uses PHP to send me an email. It is run via PHP. About 3 times a day, I get an email where the form is filled out with "1", such as Name: 1, Email: 1, Message: 1. I have the email format required for my field (requiring #whatever.com), I have a Captcha AND I have a honeypot installed, but still get these emails.
My form & captcha code:
<form method="post" action="contact.php">
<label class="contenttext">Your Name:</label>
<input name="senderName" class="inputemail" required="required"><br/><br/>
<label class="contenttext">Your Email Address:</label>
<input name="senderEmail" class="inputemail" type="email" required="required"><br/><br/>
<!-- HONEYPOT --><input type="text" id="catcher" name="catcher"/>
<textarea name="message" required="required"></textarea><br/><br/>
<script src="https://www.google.com/recaptcha/api.js" async defer></script>
<div class="g-recaptcha" data-sitekey="(mysitekey)"></div>
<br/>
<div class="capfail" id="capfail">Please check the Captcha box.</div><br/>
<script>
$("form").submit(function(event) {
var recaptcha = $("#g-recaptcha-response").val();
if (recaptcha === "") {
event.preventDefault();
$("#capfail").show();
}
});
</script>
And my PHP code:
<?php
$webmaster_email = "myemail#gmail.com";
$feedback_page = "contact.html";
$error_page = "404.shtml";
$thankyou_page = "contactsuccess.html";
$senderEmail = $_REQUEST['senderEmail'] ;
$message = $_REQUEST['message'] ;
$senderName = $_REQUEST['senderName'] ;
$msg =
"First Name: " . $senderName . "\r\n" .
"Email: " . $senderEmail . "\r\n" .
"\r\n" . "Message: " . "\r\n" . $message ;
function isInjected($str) {
$injections = array('(\n+)',
'(\r+)',
'(\t+)',
'(%0A+)',
'(%0D+)',
'(%08+)',
'(%09+)'
);
$inject = join('|', $injections);
$inject = "/$inject/i";
if(preg_match($inject,$str)) {
return true;
}
else {
return false;
}
}
if (!isset($_REQUEST['senderEmail'])) {
header( "Location: $feedback_page" );
}
elseif (empty($senderName) || empty($senderEmail)) {
header( "Location: $error_page" );
}
elseif ( isInjected($senderEmail) || isInjected($senderName) || isInjected($message) ) {
header( "Location: $error_page" );
}
elseif(!empty($_POST['catcher'])) {
header( "Location: $error_page" );
}
else {
mail( "$webmaster_email", "Feedback Form Results", $msg );
header( "Location: $thankyou_page" );
}
?>
This should effectively block auto-filling bots with the honeypot, checks if someone is human with captcha, and require the fields to fit a particular format. Is there anything else I am missing, or can anyone help me understand how I would still be getting emails like this?
UPDATE:
It was pointed out that I am not using server side validation. I can set up server side, however doing that breaks my show/hide div code in my HTML form. Is there a way to submit the form, direct to the PHP file, have my PHP check if captcha is checked and if it is NOT, take user back to the HTML file (ideally with their form still filled out so nothing is lost) and display the little "Please check the Captcha box." message just like I have set up now?

Answer 1

You're enforcing the CAPTCHA on the client rather than the server. All it takes to defeat it is for the client to disable JavaScript. You absolutely need to do all security checks on the server.

Answer 2

Ok let's go, create a validation file
validation.php
<?php
$response = file_get_contents("https://www.google.com/recaptcha/api/siteverify?secret=YOUR-SECRET-KEY&response=".$captcha_data."&remoteip=".$_SERVER['REMOTE_ADDR']);
if ($response.success) {
//run your php code here
} else {
// go back to your main page or run any other code here
header( "Location: index.php" );
}
?>
so in your html
<form method="post" action="contact.php">
<label class="contenttext">Your Name:</label>
<input name="senderName" class="inputemail" required="required"><br/><br/>
<label class="contenttext">Your Email Address:</label>
<input name="senderEmail" class="inputemail" type="email" required="required"><br/><br/>
<!-- HONEYPOT --><input type="text" id="catcher" name="catcher"/>
<textarea name="message" required="required"></textarea><br/><br/>
<script src="https://www.google.com/recaptcha/api.js" async defer></script>
<div class="g-recaptcha" data-sitekey="(mysitekey)"></div>
<br/>
<?php
$response = file_get_contents("https://www.google.com/recaptcha/api/siteverify?secret=YOUR-SECRET-KEY&response=".$captcha_data."&remoteip=".$_SERVER['REMOTE_ADDR']);
if ($response.success) {
echo '<script>
$("form").submit(function(event) {
var recaptcha = $("#g-recaptcha-response").val();
if (recaptcha === "") {
event.preventDefault();
$("#capfail").show();
}
});
</script>';
} else {
echo '<div class="capfail" id="capfail">Please check the Captcha box.</div><br/>';
}
?>