HOW TO: POSTing/GETting Data to/from the API

fanno · 2012-03-16 12:27 pm

Katana wrote:

f=json is a GET Variable

ahh any of the other variables that must be a GET ?

pedigree · 2012-03-16 2:13 pm

Just the f= param

Its easier to put the entire lot in the URL as a get param.

WSI · 2013-06-06 4:12 am

hey ya,

I run a "demo" search engine / comments etc - something i have coded...

However, tonight I had three different IP Addresses "attacking" my site... - posting comments etc...

their IP's were:
46.105.56.131
94.23.229.78
188.165.243.45

Quite horrendous really...

My first approach was to disable "guest" posting... (and then delete the 400 or so comments full of various "keywords" and wordpress domains (i have the SQL backup available with IP address / name / email entered into the comment form) - then the "user" decided to attempt to register accounts (my system requires confirmation of email address - except in certain already confirmed circumstances [IE: PayPal or FB confirm the email has been validated])...

but just incase the guy "somehow" bypasses this (ie: one of these disposable email addresses which Yahoo now produce ETC) - ive currently made a "modded" feature - where comments need vetting...

I'd prefer not to do this, so if i query an IP against your system, and nothing shows up... i wont "vet" the comment...

only found your website today though [googled the guys ip address]...

this API... do you have a sample script (PHP)?

carbonize · 2013-06-06 6:53 am

The api section will show you the URLs to request and what format the data gets returned in. Simply put the required URL in to file_get_contents and the handle the received data as normal.

carbonize · 2013-06-06 9:40 am

OK I'll break it down a little bit with some code for checking the confidence of an IP address. It's a bit rough as I just quickly threw it together.

$SFSdata = file_get_contents('http://www.stopforumspam.com/api?ip=' . $ip);
if($SFSdata !== false)
{
  $SFSdata = @unserialize($SFSdata);
  if($SFSdata !== false)
  {
    if(isset($SFSdata['ip']['confidence']))
    {
      // Do whatever you want to do with the SFS confidence level for that IP address which will be $SFSdata['ip']['confidence']
    }
  }
}
else
{
  // Something here for when the file_get_contents has failed for some reason
}

pedigree · 2013-06-06 11:06 am

If you are going to use unserialize, you need to request the data in serialize format with

$SFSdata = file_get_contents('http://www.stopforumspam.com/api?f=serial&ip=' . $ip);

WSI · 2013-06-06 12:11 pm

hi guys,

Thanks... I found the "Generate API Code" after posting my request, but it was so late (or early ) that i decided to head off to bed and forgot about this.

I guess the API is akin to the facebook secret? and should never be used in a javascript document...?

Just to confirm too...

Implementation should be something along the lines of:

1) check if ip is listed in personal database...
2) if not stored (or is old data - a week or more?) - get data from SFS.com...
3) store data in a local table (1).
4) either block or allow...
* Only to be used when "SPAM" can occur - ie: registration, commenting, (submitting URL's) etc?

if this is the correct M.O. to approach then thats cool, with the info i found on your site [after posting] and your posted messages, i can code the above...

WSI · 2013-06-06 12:14 pm

carbonize wrote:

OK I'll break it down a little bit with some code for checking the confidence of an IP address. It's a bit rough as I just quickly threw it together.

$SFSdata = file_get_contents('http://www.stopforumspam.com/api?ip=' . $ip);
if($SFSdata !== false)
{
  $SFSdata = @unserialize($SFSdata);
  if($SFSdata !== false)
  {
    if(isset($SFSdata['ip']['confidence']))
    {
      // Do whatever you want to do with the SFS confidence level for that IP address which will be $SFSdata['ip']['confidence']
    }
  }
}
else
{
  // Something here for when the file_get_contents has failed for some reason
}

is there a reason you use !== and not simply != [its been a while since i came back to PHP - but i only remember using != .... i do use "===" in javascript, *cant remember why though :S *

Maikuolan · 2013-06-06 3:09 pm

@WSI.

"!=" only matches against the value of variables, whereas "!==" will additionally match against type.

For example:

(0==false) is true.
(0===false) is false.
(1==true) is true
(1===true) is false.
("2"==2) is true.
("2"===2) is false.
(2===2) is true.
(0!==false) is true.
(0!=false) is false.

And weirdly enough...

("1a"==1) is, also true. But ("1a"===1) is false.

zero-tolerance · 2013-06-06 3:21 pm

There are generally cases where unserialise could return 0 as a successful value or false (meaning that it failed), so it's a good pattern to follow.
Another common place where you need this is the strpos() function, which returns 0 if the match happens to be at the start of the string and false if there is no match.

Last edited by zero-tolerance (2013-06-06 3:29 pm)

WSI · 2013-06-06 5:29 pm

great. thanks guys

carbonize · 2013-06-06 6:12 pm

This is the function I use in my script, slightly edited for general use. It will check both IP address and, if supplied, the email address. It will fallback to fsock if the server is set to not allow file_get_contents to open remote URLs.

http://pastebin.com/hxDzfDhr

I don't check to see if the email address is valid in this function as I have already handled that elsewhere in my script.

Last edited by carbonize (2013-06-06 6:13 pm)

WSI · 2013-06-07 7:39 pm

hi again.

Im really grateful for the help you've provided here. - I am implementing JSon on my site ATM, and notice that I can use SFS.com/api?ip=XXXX&f=json

Just popping in 123.123.123.123 i get :
{"success":1,"ip":{"lastseen":"2013-03-19 02:33:38","frequency":1,"appears":1,"confidence":8.18}}

and the for 198.27.66.119
{"success":1,"ip":{"lastseen":"2013-06-07 19:34:09","frequency":375,"appears":1,"confidence":99.6}}

http://www.stopforumspam.com/usage

As this data reflects that the last IP has just spammed me, and is listed as red with a fair few hits recently... I guess that means that my "check" would blacklist him pretty much immediately...

however, How do you guys check on the confidence before blacklisting ETC? what do you do with the confidence exactly? - "if (confidence > 50%){ show capture to proceed or just tell them to F.... off.? }

with email addresses, check every email address? or just yahoo / msn / etc? (I assume that most spammers dont spam from @myname.com? - nearly all my spam is from XXXXXSSWofdjldkfjlaklaldk@free-email.com?

I assume we need to be conservative somewhat to not burden SFS?

- also, the 3-400 spam posts on my forum, Shall i use the API to list each spam by a user from one IP, or just one of them? - shall i create a DB table "ReportedIPs" and only report again if it is not a recent report (IE: LastReport < date()-10days) or?

as for the "Evidence" - what shall I post properly into that field? - Message *and therefore the spam content* or (post/comment X on XYZ(mysite).com)

Last edited by WSI (2013-06-07 7:42 pm)

carbonize · 2013-06-07 7:45 pm

In my case I block the post of the confidence level is above X where X is the level at by the user from 25, 50, 90

WSI · 2013-06-07 7:45 pm

carbonize wrote:

This is the function I use in my script, slightly edited for general use. It will check both IP address and, if supplied, the email address. It will fallback to fsock if the server is set to not allow file_get_contents to open remote URLs.
http://pastebin.com/hxDzfDhr
I don't check to see if the email address is valid in this function as I have already handled that elsewhere in my script.

Thanks for the script. - ive only just got another few spare minutes to implement it... - going straight into my site. (one database across all my websites I feel)

WSI · 2013-06-07 7:47 pm

carbonize wrote:

In my case I block the post of the confidence level is above X where X is the level at by the user from 25, 50, 90

Level... 25, 50, 90?...
OK... You refer to forum level or something else?

So for say a "Contact form"... you mean if level > 25%?

carbonize · 2013-06-07 8:09 pm

I mean they submit the post and I then run it through various checks. The last check is the SFS database and if the confidence level returned by SFS for that IP is above the set level then I return a message telling them their post has been blocked.

pedigree · 2013-06-07 8:31 pm

WSI wrote:

carbonize wrote:
In my case I block the post of the confidence level is above X where X is the level at by the user from 25, 50, 90
Level... 25, 50, 90?...
OK... You refer to forum level or something else?
So for say a "Contact form"... you mean if level > 25%?

If you get api results in XML/json or serial format, you get another field, called confidence with gives a weighted score of the likelihood of you getting spammed.

WSI · 2013-06-07 8:56 pm

hi sorry,

i wasn't too clear with my post. however, looking at the front, i see that requests are limited to 20,000 a day. currently with signups / comments etc, theres no chance that will come near to 1,000. So ill implement it onto registration for now, and keep with "user only" posting.

carbonize · 2013-06-07 9:02 pm

Ah yes I should explain that in my case it is implemented in to a guestbook and not a forum. I do have it in my SMF based forum which checks on user registration to see if they are listed.

#26 2012-03-16 12:27 pm

Re: HOW TO: POSTing/GETting Data to/from the API

#27 2012-03-16 2:13 pm

Re: HOW TO: POSTing/GETting Data to/from the API

#28 2013-06-06 4:12 am

Re: HOW TO: POSTing/GETting Data to/from the API

#29 2013-06-06 6:53 am

Re: HOW TO: POSTing/GETting Data to/from the API

#30 2013-06-06 9:40 am

Re: HOW TO: POSTing/GETting Data to/from the API

#31 2013-06-06 11:06 am

Re: HOW TO: POSTing/GETting Data to/from the API

#32 2013-06-06 12:11 pm

Re: HOW TO: POSTing/GETting Data to/from the API

#33 2013-06-06 12:14 pm

Re: HOW TO: POSTing/GETting Data to/from the API

#34 2013-06-06 3:09 pm

Re: HOW TO: POSTing/GETting Data to/from the API

#35 2013-06-06 3:21 pm

Re: HOW TO: POSTing/GETting Data to/from the API

#36 2013-06-06 5:29 pm

Re: HOW TO: POSTing/GETting Data to/from the API

#37 2013-06-06 6:12 pm

Re: HOW TO: POSTing/GETting Data to/from the API

#38 2013-06-07 7:39 pm

Re: HOW TO: POSTing/GETting Data to/from the API

#39 2013-06-07 7:45 pm

Re: HOW TO: POSTing/GETting Data to/from the API

#40 2013-06-07 7:45 pm

Re: HOW TO: POSTing/GETting Data to/from the API

#41 2013-06-07 7:47 pm

Re: HOW TO: POSTing/GETting Data to/from the API

#42 2013-06-07 8:09 pm

Re: HOW TO: POSTing/GETting Data to/from the API

#43 2013-06-07 8:31 pm

Re: HOW TO: POSTing/GETting Data to/from the API

#44 2013-06-07 8:56 pm

Re: HOW TO: POSTing/GETting Data to/from the API

#45 2013-06-07 9:02 pm

Re: HOW TO: POSTing/GETting Data to/from the API

Board footer