0

I have a portfolio website and i'm planning on allowing comments as a sort of "guestbook" feature. What are some things i should consider before starting? I don't want to get screwed over by a malicious user. Here's some of my thoughts

  • Comment needs to be approved before appearing on the website
  • Insert comment onto website as text instead of html
  • Limit input size
  • Storage requirements are minimal, probably going to use SQLite, therefore i'm aware of preventing sql injections. Also considering MongoDB. I'm going to be storing very little data, so I just need a simple and easy database.

Comment approval theoretically trumps all other security measures, but I want to know that i'm heading in the right direction. Like what if one day, i decide to stop moderating comments? Then the rest of the security measures should still work.

|improve this question
  • 1
    Your #1 concern will be spam bots. Once they find a form, they'll be hammering it with submissions. Make sure you use something that prevents automated submission. – GrandmasterB May 12 '17 at 16:45
  • 3
    There are existing services you can integrate such as disqus: disqus.com maybe it already does most of what you want? Also: hashover tildehash.com and isso posativ.org/isso – FrustratedWithFormsDesigner May 12 '17 at 17:13
  • Tildehash and isso are good references. If you prefer to hack your own, I srtarted an extremely basic commenting system, github.com/MorganConrad/commentR, which perhaps you could modify for your needs. I gave up cause the needs are tricky and vary from site to site, and security is tricky. – user949300 May 12 '17 at 18:40
2

Sanitation...

You say:

Comment approval theoretically trumps all other security measures

But by the time you are reviewing the comment, it's already inserted into your database and being displayed in at least one browser (yours).

If you don't validate and sanitise the user contributed input you're going to suffer SQL injections and cross-site scripting attacks and more...

|improve this answer
0

Limiting/treating everything as text is going to protect you from most of the big problems. This will not be the most exciting thing ever. You will want to protect from very large messages. Keep in mind that this protection much be handled on the server. Just limiting the text box size will not prevent someone from crafting a message that they send directly to your server.

If you start adding features like links and whatnot, it's a whole different ballgame.

|improve this answer
0

You can read about data validation here

Also integrating with services like Google captcha can help to filter automated bots and implementing a 'honeypot' as described here

Those three simple solutions should reduce most of the spam.

|improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.