EvilZone

Do not get me started on the Windows OS.  I'm running on Windows 7 at the minute and I can honestly say that it's the biggest piece of shit going.  I'll post a thread on how to tighten your window security and link it here soon.

Well, I work at a Web Solutions company and our server has been sending out a lot of spam and we're getting a lot of requests from chinese web servers.  This has lead me to believe that our contact forms are being injected.  I've written some PHP that will only allow the email to be sent if certain conditions are met - here is the code.

(form-check.php - include) Generates random key, saves it in session variable. 
<?php
session_start();
function generateKybit ($length = 40){
    $bitkey = "";
    $possible = '123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ!"£$%^&*()';
    $maxlength = strlen($possible);
    
    if ($length > $maxlength) {
        $length = $maxlength;
    }
    $i = 0;
    
    while ($i < $length) {
        $char = substr($possible, mt_rand(0, $maxlength-1), 1);
        if (!strstr($bitkey, $char)) {
            $bitkey .=$char;
            $i++;
        }
    }
    return md5($bitkey);
}
$_SESSION['kybit'] = generateKybit();
?>
(do-send.php - action of form | post)

<?php
session_start();
$sendto = "info@you.com";
$details = array(htmlentities($_POST['name']),$_POST['email'],htmlentities($_POST['phone']));
$message = "A person has tried to contact you via your website.\nName: " . $details[0] . "\nNumber: " . $details[2] . "\nEmail: " . $details[1];
if (isset($_SESSION['kybit'])){
    
} else {
    $_SESSION['kybit'] = rand(5, 40);
}
$kybit['client'] = $_SESSION['kybit'];
$kybit['server'] = $_GET['ky'];
if ($kybit['client'] == $kybit['server']){
    if(!filter_var($details[1], FILTER_VALIDATE_EMAIL))
    {
    exit("<div style='font-family:Arial;background-color:#FF7A7A;border:solid 5px #C90000;padding:20px;width:170px;margin:0 auto;'><p><strong>E-mail is not valid.<br/> <a href='index.php'> &laquo; Go Back</a></strong></p>");
    }
    mail($sendto,'Website Enqiry', $message);
    $_SESSION['kybit'] = rand(5, 40);
        echo "<div style='font-family:Arial;background-color:#A6FFA7;border:solid 5px #007A02;padding:20px;width:170px;margin:0 auto;'><p><strong>Email Sent!</strong><br/> <a href='index.php'> &laquo; Go Back</a></strong></p>";
} else {
    echo "<div style='font-family:Arial;background-color:#FF7A7A;border:solid 5px #C90000;padding:20px;width:170px;margin:0 auto;'><p><strong>Invalid Security Token</strong></p>";
}
?>

If the md5 attached via GET matches the md5 sent via POST then the e-mail sends.  If not, it returns an error and does not send the e-mail.  The keys are unique and can only be used once.

Have I wasted my time doing this and if so, is there a quicker alternative to securing forms?  I have considered implementing captcha fields into my forms, but with just shy of 1,000 customers - it's a bit too much hassle (playing with public/private keys, etc.)