Secure simple registration form

I have a simple registration form that bots are adding 10 or so a day to. I need the form secured against bots. it should be only 1 to 2 hours work Your task is: If post code is not 4 numbers then fail if country is not AUS the fail HONEY POT This method relies on the assumption that SPAM software doesn't recognize CSS and/or JavaScript. The "honey pot" technique use a non-visible field to fool the less-intelligent robots whos automatically fills out all the input fields prior to submit the form data for further processing. CSRF TOKEN Synchronizer token pattern uses a unique token that is embedded into the HTML forms and verified on the server side. The CSRF token should be a random value that is hard to predict, preferably generated by a cryptographical algorithm. This is how to build a CSRF token: ================================== Mention SKY in the comments or your bid will be ignored. The task will be compleat when bots are not doing fake registrations example code is below for adding the above ==================================== HONEY POT This method relies on the assumption that SPAM software doesn't recognize CSS and/or JavaScript. The "honey pot" technique use a non-visible field to fool the less-intelligent robots whos automatically fills out all the input fields prior to submit the form data for further processing. <form action="[login to view URL]" method="post"> <p> <label>Name</label> <input type="text" name="your_name"> </p> <p> <label>Email</label> <input type="email" name="your_email"> </p> <p class="fax"> <label>Fax</label> <input type="text" name="your_fax"> </p> <p> <label>Comment</label> <textarea name="your_comment"></textarea> </p> <p> <button type="submit">Submit</button> </p> </form> Then use CSS to hide the "honey pot" from your form so visitors are not able to see and fill it. <style> .fax { display: none; } </style> You can also use JavaScript to assure yourself this input field will not harm your form. <script> [login to view URL]('.fax').[login to view URL] = 'none'; </script> So, if visitors can't see and fill the non-visible input fields we can consider that the form submission with not empty fax is spam. <?php // [login to view URL] if (!empty($_POST['fax'])) { // It's SPAM } ?> ============================================== 2 ============================================== CSRF TOKEN Synchronizer token pattern uses a unique token that is embedded into the HTML forms and verified on the server side. The CSRF token should be a random value that is hard to predict, preferably generated by a cryptographical algorithm. This is how to build a CSRF token: <?php // PHP 7 $token = bin2hex(random_bytes(32)); // PHP 5.3 with mcrypt $token = bin2hex(mcrypt_create_iv(32, MCRYPT_DEV_URANDOM)); // PHP 5.3 with openssl $token = bin2hex(openssl_random_pseudo_bytes(32)); // PHP 4 $token = base64_encode(time() . sha1($_SERVER['REMOTE_ADDR'] . $_SERVER['HTTP_USER_AGENT']) . md5(uniqid(rand(), true))); // Store the token into a session variable! $_SESSION['token'] = $token; ?> Then include the token into your HTML form. <form action="[login to view URL]" method="post"> <input type="hidden" name="token" value="<?php echo $token; ?>"> </form> To validate a token you must compare the form value with the session value. <?php // [login to view URL] if ($_SESSION['token'] !== $_POST['token']) { // It's SPAM } ?> ================================================= =================================================