you only need to check, do we have a value for this input? If so, we have a bot on our hands, because your users would never encounter it. Only the bot. That's the general technique here. So let's give it a shot. We're going to go to our routes file, and we'll slowly improve this along the way. But first, I want to show you the basic flow here. Let's start by saying, if we don't have anything for myName, then maybe they're submitting it as a cURL request, or for some reason, myName doesn't exist as part of the request. If that's the case, we have a problem.

it as a cURL request, or for some reason, myName doesn't exist as part of the request. If that's the case, we have a problem. So let's just start by aborting. A 422 sounds about right. Spam detected. A 422 is basically your way of saying, I understood everything. I know what you intended to do here, but I ain't going to do it. So it's a good use case for failed validation, or even spam detection. So that's one thing to check for. But we might also say, look, let's grab myName, and if it's not empty, meaning it was filled

So that's one thing to check for. But we might also say, look, let's grab myName, and if it's not empty, meaning it was filled out, then we have a bot on our hands. So let's try this, and then once again, abort(). OK, there's our first stab. So let's go back to our view, and I'm going to show this section only for your benefit, but just keep in mind, when we are done with this, the users will never see this. That's the entire point. But in our case, we will. So now, think about it.

filled. Well, for any regular person, it's at least, at a bare minimum, going to be a few seconds. If instead, it was filled out in half a second, again, that's a dead ringer that you have a spammer on your hands. So why don't we check for that as well? That'll be the second component to our honeypot technique. Let's go back to post/create, and then right down here, let's add another one here. Form input, and by the way, we're going to clean all of this up to make it nice and reusable from form to form. But for now, I'm just showing you the general approach.

from form to form. But for now, I'm just showing you the general approach. We'll say $time. This will have a value of microtime, and we do want a float. We don't need errors, so I can get rid of those. All right, let's have a look. Come back and refresh, and now we have a field that should be left blank, and then another field that has the timestamp of exactly when the page loaded. So think about it, now, back to our routes file, let's check how long it took to fill out the form.

So think about it, now, back to our routes file, let's check how long it took to fill out the form. We can do something like this. Let's once again get the microtime. So we have the beginning, and we have the ending. And let's see, we'll say create a variable called elapsed that will be now minus the timestamp from, what did we call it, myTime, and that'll give us how long it has been. So let's just die and say form submitted in elapsed. All right, let's give it a shot. So we run it, one, two, three, four, I'll click it, and there we go.

All right, let's give it a shot. So we run it, one, two, three, four, I'll click it, and there we go. Form submitted in 5.8 seconds. So now let's check for something incredibly slow. Maybe we could say if you fill it out in less than three seconds, something fishy is going on here. So we could say if elapsed is less than or equal to three seconds, again, we probably have spam on our hands. Or in other words, do you want to allow anyone to spend less than three seconds providing a Post here?

First, if the bot fills out an input that we intend to be blank, it's spam. And second, if they fill out the form too quickly, it is spam. So now, again, I assure you we're going to clean all of this up. But to wrap up this initial lesson, all you have to do at this point, let's grab this and this one, and we're going to wrap it within a new div where I'll set a display of none or use tailwind, whatever you want. Okay, so here's what your users see. A bot will see all of this regardless of whether the display is set to none or not. Okay, so your regular users fill it out, and this will work. No problem there at all.