HOW TO: POSTing/GETting Data to/from the API

pedigree · 2009-12-06 7:26 pm

In order for email/usernames to be correctly added to the database when POSTing data, they must be correctly encoded.

For PHP, then means submitting the details using the urlencode() function

eg

"username=" . $urlencode($username) . "&email=" . urlencode($email)

We are seeing an increased amount of submissions where the data is not correctly encoded, the main issue being that + signs are not being encoded correctly but being left as + signs. This means that a space is inserted in the email (eg) instead of a + sign.

nullamatix.com · 2009-12-11 4:50 am

This will also work:

$p = http_build_query(
    array(
        'username' => 'spammer',
        'ip_addr' => '172.16.20.99',
        'email' => 'spammer@stinkyspam.com',
        'api_key' => 'xxxxxxxxxx'
    )
);

php.net wrote:

Generates a URL-encoded query string from the associative (or indexed) array provided.

Mast3rpyr0 · 2010-01-15 1:17 am

i am attempting to add this into my PHPBB board so that whenever i ban someone by IP, it also submits to you guys.

I have added the following under what is executed upon selecting an IP Ban from the admin panel:

$php_load_options = array(
                    'return_info' => true,
                    'method' => 'post'
                    );
                    
                $php_load_url = 'http://www.stopforumspam.com/post.php?username='.$user->lang['USERNAME'].'&ip_addr='.$user->lang['IP_HOSTNAME'].'&email='.$user->lang['EMAIL_ADDRESS'].'&api_key=XXXXXXXX';    
                    
                $php_load_result = load($php_load_url,$php_load_options);

the php_load_options is a custom script that is supposed to load the URL, and i assume i set that up correctly.

Am I missing something?

nullamatix.com · 2010-01-15 2:13 am

I'm not familiar with phpbb, but this is what I'm using to submit via the WordPress comments page.

function submit_spam($uname, $ip, $em) {
        $postdata = http_build_query(
                array(  
                        'username' => $uname,
                        'ip_addr' => $ip,
                        'email' => $em,
                        'api_key' => 'abcdefg123456')
        );
        $opts = array(
                'http' => array(
                        'method'  => 'POST',
                        'header'  => 'Content-type: application/x-www-form-urlencoded',
                        'content' => $postdata
                )
        );
        $context  = stream_context_create($opts);
        $result = file_get_contents('http://www.stopforumspam.com/post.php', false, $context);
        return $result;
}

To execute the function, I just click a link...

/?uid=SpammerName&uip=SpammerIP&uem=SpammerEmail

Which, if all the variables exist, runs:

submit_spam($uid, $uip, $uem);

Porting that to phpbb shouldn't be too much trouble.. Keep us posted.

Guy
www.nullamatix.com

pedigree · 2010-01-15 2:23 am

Mast3rpyr0 wrote:

Am I missing something?

yes, the several other threads that exactly the same thing has been solved.

You POST to post.php

You GET to add.php

but as I dont have the rest of the functions, I cant help out. The certainly isnt how you build a post form though, change it to add.php and post to get

And for the love of god

DO NOT POST YOUR API KEY in the forums

Because you did, I had to delete the API key incase someone decided to start using it. Youll need to get another one

Spud · 2010-01-15 11:44 am

LOL are you actually saying that this poor API key was actually used? (abcdefg123456)? Talk about weak passwords, Anyone using such deserves to be hacked.

Passwords should be a minimum of 10 characters long and contain upper/lower case characters, numbers and *%$) symbols too. It's the only way to help ensure your sites safety.

pedigree · 2010-01-15 1:26 pm

no, one that I editted and replaced with XXXXXXXXXX

Spud · 2010-01-15 9:27 pm

Hehe thank god, I actually thought someone was dense enough to use something like that (No offense intended to nullamatix.com as it was not your doing).

Odis · 2010-01-27 11:51 pm

nullamatix.com wrote:

I'm not familiar with phpbb, but this is what I'm using to submit via the WordPress comments page.

function submit_spam($uname, $ip, $em) {
        $postdata = http_build_query(
                array(  
                        'username' => $uname,
                        'ip_addr' => $ip,
                        'email' => $em,
                        'api_key' => 'abcdefg123456')
        );
        $opts = array(
                'http' => array(
                        'method'  => 'POST',
                        'header'  => 'Content-type: application/x-www-form-urlencoded',
                        'content' => $postdata
                )
        );
        $context  = stream_context_create($opts);
        $result = file_get_contents('http://www.stopforumspam.com/post.php', false, $context);
        return $result;
}

To execute the function, I just click a link...

/?uid=SpammerName&uip=SpammerIP&uem=SpammerEmail

Which, if all the variables exist, runs:

submit_spam($uid, $uip, $uem);

Porting that to phpbb shouldn't be too much trouble.. Keep us posted.

Guy
www.nullamatix.com

Where do you add that in wordpress? I'd like a simple way to report comments via the wordpress page.

I found your plugin on your website. Can you add an option to this plugin that will allow the data to be sent to stopforumspam.com with my API key just by clicking a link. This would save the trouble of having to copy and paste. Perhaps tying it into the existing "Report & Delete" of wordpress?

Last edited by Odis (2010-01-28 12:10 am)

EOC_Jason · 2010-02-02 4:27 pm

Hey guys,

You might want to make mention of the GET method (and URL) on the API page. The existing POST info with URL is a little misleading since you don't actually POST with the URL variables in the string.

I was a little confused as to why my information wasn't auto-submitting for confirmed spammers till I realized it had to be POST and not GET for the example info on the API page.

pedigree · 2010-02-02 6:13 pm

I know, Ive updated it on the new code that will be rolled out soon. There is a large chunk of updates as you can post data in this format or in json and php serialize as well.

Garf · 2011-05-06 7:33 am

By the way, integrating the checking code is really easy because of the serialization support.

Unfortunately, the add.php doesn't seem to have something similar which would be handy for checking return code/failure reasons. Consider adding PHP/JSON serialization support similar as for the checking script. i.e.

http://www.stopforumspam.com/add.php
?username=USERNAME
&ip_addr=IPADDRESS
&email=EMAILADDRESS
&api_key=ZZZZZZZZZZZZZZZ
&f=serial

And the response can be fed to unserialize.

pedigree · 2011-05-06 5:01 pm

the add code will soon respond to serialized php/json. i just need to find some time to test it but the code is there, just not enabled

jacostrauss · 2011-05-08 4:10 am

Do you have sample ASP code I can use to submit Spammers to you DB as I intercept them? I currently only log them in my db and display them here on my "Trophy Page" http://www.strauss.za.com/asp/Junk.asp .I only display the current day's results and as my site is hosted in the US, the list is cleared every day at 6 .a.m. GMT.

Thanks

Jaco Strauss

pedigree · 2011-05-08 7:28 am

I dont but I have seen some around before.

There is some here but its going to need some edits

http://www.stopforumspam.com/forum/p758 … 01-15-6:50

pedigree · 2011-05-08 9:58 pm

Garf wrote:

By the way, integrating the checking code is really easy because of the serialization support.
Unfortunately, the add.php doesn't seem to have something similar which would be handy for checking return code/failure reasons. Consider adding PHP/JSON serialization support similar as for the checking script. i.e.
http://www.stopforumspam.com/add.php
?username=USERNAME
&ip_addr=IPADDRESS
&email=EMAILADDRESS
&api_key=ZZZZZZZZZZZZZZZ
&f=serial
And the response can be fed to unserialize.

http://www.stopforumspam.com/add.php?us … Z&f=serial

responds with

a:3:{s:7:"success";i:0;s:5:"errno";N;s:5:"error";s:26:"could not validate api key";}

and json

{"success":0,"errno":null,"error":"could not validate api key"}

and xmldom

<?xml version="1.0" encoding="UTF-8"?>
<root>
    <success>0</success>
    <errno></errno>
    <error>could not validate api key</error>
</root>

and xmlcdata

<?xml version="1.0" encoding="UTF-8"?>
<array>
    <success><![CDATA[0]]</success>
    <errno>![CDATA[]]
    </errno>
    <error><![CDATA[could not validate api key]]</error>
</array>

pedigree · 2011-05-08 10:07 pm

SFS_MAINT_MODE => maintenance mode record processing deferred
SFS_ADD_DUPLICATE => duplicate record from your apikey
SFS_ADD_INVALID_APIKEY => could not validate api key
SFS_ADD_SANITY => you cannot submit your own email address
SFS_ADD_MYSQL_ERROR => database error deferred processing failed
SFS_FORMAT_ERROR => serialized data invalid

There are still a couple that I need to include in the error list

DEFINE ('SFS_ADD_NO_ERROR', 0);
DEFINE ('SFS_ADD_INVALID_EMAIL', 1);
DEFINE ('SFS_ADD_INVALID_IP', 2);
DEFINE ('SFS_ADD_INVALID_USER', 4);
DEFINE ('SFS_ADD_INVALID_APIKEY', 8);
DEFINE ('SFS_ADD_INVALID_SELF_EMAIL', 16);
DEFINE ('SFS_ADD_INVALID_SELF_IP', 32);
DEFINE ('SFS_ADD_MYSQL_ERROR', 64);
DEFINE ('SFS_ADD_MYSQL_ERROR_SC', 128);
DEFINE ('SFS_ADD_NOSQL_INSERT_ERROR', 256);
DEFINE ('SFS_ADD_DUPLICATE', 512);
DEFINE ('SFS_ADD_SANITY', 1024);
DEFINE ('SFS_ADD_FIELD_ERROR', 32768);
DEFINE ('SFS_MAINT_MODE', 65536);

These will change a lilttle, I just noticed an oversight in the numbering. Ill get this done tomorrow. At the moment, its not correctly adding the bit values up for field errors when more than one field errors.

Katana · 2011-05-09 1:48 am

pedigree, when are you going to update the API docs with that info as well, so it's easier on everyone trying to work with the API?

pedigree · 2011-05-09 8:16 am

Yup, Ill update all the api doc as well.

jacostrauss · 2011-05-11 12:16 pm

Hi

Further to my previous post, the following ASP code works just fine for posting my banned spammers ( http://www.strauss.za.com/asp/Junk.asp ) here automatically. I only submit them once they've reached 4 Spam attempts at my site. The ones that have spammed me less than 4 times are not submitted (yet) in case I have miss-classified them, or they use a once-off IP addresses.

Any case, here is the VBScript code I use:

IF bBanned = True THEN

sSQL = "username=" & sName & "&ip_addr=" & sIP & "&email=" & sEmail & "&api_key=xxxxxxx"

set oXML_HTTP = server.Createobject("MSXML2.ServerXMLHTTP")
oXML_HTTP.Open "POST","http://www.stopforumspam.com/add.php?",false
oXML_HTTP.setRequestHeader "Content-Type", "application/x-www-form-urlencoded"
oXML_HTTP.send sSQL
Response.ContentType = "text/xml"
Response.Write oXML_HTTP.responsexml.xml
Set oXML_HTTP = nothing

END IF

Thanks for a great site and service

Jaco

kbdavis07 · 2011-05-15 12:00 am

Need asp.net C# code to post to the database.

Katana · 2011-10-15 7:38 pm

Ped, regarding all the constants, what's the up-to-date info on the numbers, the constants, and what each of them is for?

pedigree · 2011-10-15 7:51 pm

Ill post those up shortly as some have been added for the new api code

fanno · 2012-03-16 6:10 am

Hello all

$post = array(
'username' => $usename,
'ip_addr' => $ip,
'email' => $email,
'f' => 'json',
'api_key' => $apikey,
'evidence' => $evidence
);

even i provide 'f' => 'json' it is not json

is that what you would expect ? i am using a curl method to send instead of the other suggested methods ? is that a factor?

i have tried both:
http://www.stopforumspam.com/post.php
and
http://www.stopforumspam.com/add.php

-Thanks

Katana · 2012-03-16 12:02 pm

f=json is a GET Variable

#1 2009-12-06 7:26 pm

HOW TO: POSTing/GETting Data to/from the API

#2 2009-12-11 4:50 am

Re: HOW TO: POSTing/GETting Data to/from the API

#3 2010-01-15 1:17 am

Re: HOW TO: POSTing/GETting Data to/from the API

#4 2010-01-15 2:13 am

Re: HOW TO: POSTing/GETting Data to/from the API

#5 2010-01-15 2:23 am

Re: HOW TO: POSTing/GETting Data to/from the API

#6 2010-01-15 11:44 am

Re: HOW TO: POSTing/GETting Data to/from the API

#7 2010-01-15 1:26 pm

Re: HOW TO: POSTing/GETting Data to/from the API

#8 2010-01-15 9:27 pm

Re: HOW TO: POSTing/GETting Data to/from the API

#9 2010-01-27 11:51 pm

Re: HOW TO: POSTing/GETting Data to/from the API

#10 2010-02-02 4:27 pm

Re: HOW TO: POSTing/GETting Data to/from the API

#11 2010-02-02 6:13 pm

Re: HOW TO: POSTing/GETting Data to/from the API

#12 2011-05-06 7:33 am

Re: HOW TO: POSTing/GETting Data to/from the API

#13 2011-05-06 5:01 pm

Re: HOW TO: POSTing/GETting Data to/from the API

#14 2011-05-08 4:10 am

Re: HOW TO: POSTing/GETting Data to/from the API

#15 2011-05-08 7:28 am

Re: HOW TO: POSTing/GETting Data to/from the API

#16 2011-05-08 9:58 pm

Re: HOW TO: POSTing/GETting Data to/from the API

#17 2011-05-08 10:07 pm

Re: HOW TO: POSTing/GETting Data to/from the API

#18 2011-05-09 1:48 am

Re: HOW TO: POSTing/GETting Data to/from the API

#19 2011-05-09 8:16 am

Re: HOW TO: POSTing/GETting Data to/from the API

#20 2011-05-11 12:16 pm

Re: HOW TO: POSTing/GETting Data to/from the API

#21 2011-05-15 12:00 am

Re: HOW TO: POSTing/GETting Data to/from the API

#22 2011-10-15 7:38 pm

Re: HOW TO: POSTing/GETting Data to/from the API

#23 2011-10-15 7:51 pm

Re: HOW TO: POSTing/GETting Data to/from the API

#24 2012-03-16 6:10 am

Re: HOW TO: POSTing/GETting Data to/from the API

#25 2012-03-16 12:02 pm

Re: HOW TO: POSTing/GETting Data to/from the API

Board footer