YForm Spam Protection - Keywords: Spam, Bot-Schutz, Honeypot, Timer, IP-Sperre, reCAPTCHA, Formular-Schutz, DSGVO

$yform = new rex_yform();
$yform->setValueField('spam_protection', [
    'honeypot', 
    'Bitte nicht ausfüllen.', 
    'Ihre Anfrage wurde als Spam erkannt.', 
    0 // Debug-Modus (0 = aus, 1 = an)
]);

// Formular 1
$yform1 = new rex_yform();
$yform1->setObjectparams('form_name', 'kontakt_formular');
$yform1->setValueField('spam_protection', ['honeypot', 'Label', 'Fehler', 0]);

// Formular 2
$yform2 = new rex_yform();
$yform2->setObjectparams('form_name', 'newsletter_formular');
$yform2->setValueField('spam_protection', ['honeypot', 'Label', 'Fehler', 0]);

rex_config::set('yform_spam_protection', 'timer_session', 10);
// Mindestens 10 Sekunden zwischen Aufruf und Submit

rex_config::set('yform_spam_protection', 'timer_form', 5);
// Mindestens 5 Sekunden zwischen Formular-Laden und Submit

rex_config::set('yform_spam_protection', 'ip_block_limit', 10);
// Erlaubt 10 Anfragen statt 5

rex_config::set('yform_spam_protection', 'ip_block_timer', 600);
// 10 Minuten statt 5 Minuten

rex_config::set('yform_spam_protection', 'ip_whitelist', '192.168.1.100,10.0.0.1');

rex_config::set('yform_spam_protection', 'ignore_user', true);
// Eingeloggte Backend-User werden nicht geprüft

rex_config::set('yform_spam_protection', 'use_stopforumspam', true);
// Prüft IP gegen externe Spam-Datenbank

$yform->setValueField('spam_protection', [
    'honeypot', 
    'Falls Sie ein Mensch sind, lassen Sie dieses Feld leer.', 
    'Spam erkannt!', 
    0
]);

$yform->setValueField('spam_protection', [
    'honeypot', 
    'Bitte nicht ausfüllen.', 
    'Ihre Anfrage wurde als Spam erkannt. Bitte versuchen Sie es in einigen Minuten erneut.', 
    0
]);

// Mit Sprog-Platzhaltern
$yform->setValueField('spam_protection', [
    'honeypot', 
    '', 
    '', 
    0
]);

$sql = rex_sql::factory();
$count = $sql->getArray(
    'SELECT COUNT(*) as count FROM rex_tmp_yform_spam_protection_frequency 
     WHERE ipv4 = INET_ATON(:ip)', 
    [':ip' => $_SERVER['REMOTE_ADDR']]
)[0]['count'];

echo "Diese IP hat $count Anfragen im Zeitfenster.";

$sql = rex_sql::factory();
$blocked = $sql->getArray(
    'SELECT INET_NTOA(ipv4) as ip, COUNT(*) as count 
     FROM rex_tmp_yform_spam_protection_frequency 
     WHERE was_blocked = 1 
     GROUP BY ipv4'
);

foreach ($blocked as $entry) {
    echo "IP {$entry['ip']}: {$entry['count']} blockierte Anfragen<br>";
}

$timer = rex_config::get('yform_spam_protection', 'ip_block_timer', 300);
$sql = rex_sql::factory();
$sql->setQuery(
    'DELETE FROM rex_tmp_yform_spam_protection_frequency 
     WHERE createdate < (NOW() - INTERVAL ' . $timer . ' SECOND)'
);

// Manuelle API-Anfrage
$ip = $_SERVER['REMOTE_ADDR'];
$result = file_get_contents('http://api.stopforumspam.org/api?ip=' . $ip);

$doc = new DOMDocument();
$doc->loadXML($result);
$appears = $doc->getElementsByTagName('appears')[0]->nodeValue;

if ($appears == 'yes') {
    echo "IP ist in StopForumSpam-Datenbank gesperrt!";
}

// Im Backend unter YForm → Spamschutz → Erweiterte Einstellungen
rex_config::set('yform_spam_protection', 'timer_session', 30);
rex_config::set('yform_spam_protection', 'timer_form', 30);
// Jetzt 30 Sekunden warten, um Formular zu testen

// ytemplates/custom/value.spam_protection.tpl.php
<div id="<?= $this->getHTMLId() ?>" style="display:none;">
    <label for="<?= $this->getFieldId() ?>"><?= $this->getLabel() ?></label>
    <input id="<?= $this->getFieldId() ?>" 
           name="<?= $this->getFieldId() ?>" 
           type="email" 
           autocomplete="off" 
           tabindex="-1">
    <input id="<?= $this->getFieldId() ?>_microtime" 
           name="<?= $this->getFieldId() ?>_microtime" 
           type="hidden" 
           value="<?= microtime(true) ?>">
    <input id="<?= $this->getFieldId() ?>_js_enabled" 
           name="<?= $this->getFieldId() ?>_js_enabled" 
           type="hidden" 
           value="0">
</div>
<script nonce="<?= rex_response::getNonce() ?>">
    document.getElementById("<?= $this->getFieldId() ?>_js_enabled").value = 
        new Date().getFullYear();
</script>

// boot.php
rex_extension::register('YFORM_DATA_ADDED', function($ep) {
    $params = $ep->getParams();
    $form = $params['form'];
    
    // Custom Spam-Check
    if (strpos($form->getValue('nachricht'), 'spam-keyword') !== false) {
        rex_logger::factory()->log('warning', 'Spam detected in form', [], __FILE__, __LINE__);
    }
});

$sql = rex_sql::factory();
$stats = $sql->getArray(
    'SELECT 
        DATE(createdate) as date,
        COUNT(*) as total,
        SUM(was_blocked) as blocked
     FROM rex_tmp_yform_spam_protection_frequency 
     GROUP BY DATE(createdate) 
     ORDER BY date DESC 
     LIMIT 7'
);

foreach ($stats as $day) {
    echo "{$day['date']}: {$day['total']} Anfragen, {$day['blocked']} blockiert<br>";
}

// Wird automatisch ausgeführt
rex_sql_table::get(rex::getTable('tmp_yform_spam_protection_frequency'))->drop();
rex_config::removeNamespace('yform_spam_protection');

// Nur einmal pro Seite
echo $this->getArticle(1, 1); 

// NICHT:
echo REX_ARTICLE[1];
echo REX_ARTICLE[1]; // 2x = Problem!

// Richtig:
rex_config::set('yform_spam_protection', 'ip_whitelist', '192.168.1.1,10.0.0.1');

// Falsch:
rex_config::set('yform_spam_protection', 'ip_whitelist', '192.168.1.1, 10.0.0.1'); // Leerzeichen!