This tip will help you in protecting your email address from spambots. Avoiding spam is not easy and there are several steps you can take to stop spam. However, this tip describes just one of ways of protection against it. The tip describes how to prevent spambots from picking your email address from your web site.
When you include a mailto tag in a web page, you expose your email to spammers. Getting an email address from a mailto tag is quite easy. You would have noticed that email addresses follow a set format. Spambots are spider like programs that move around on the internet checking HTML documents for this format. When they find it, they extract the email address and store it for their diabolical needs.
But there is a way to fool spambots. If you write the email address as a series of special characters, instead of alphabet, it's highly unlikely that spambots would be able to pick it up.
Each lowercase alphabet has a corresponding special character that we call a Character Entity. In addition to lowercase alphabet, there are special characters for @, the underscore, the period and the hyphen. You can find the full list of HTML Special Characters of Character Entities in the Web Design section.
Each special character starts with an ampersand sign, followed by a hash, then a specific numeric value and ends with a semicolon. Thus, the special character for a is a for b is b and so on.
Now if you have an email address like bard@somewhere.com, you should write it as a series of special characters:
bard@somew
mere.com
This looks really messed up.. but that's the price you have to pay to protect yourself from spam.
However, the above method is not foolproof. Addition of a few lines of code to the spambot can ensure that the script searches for email addresses in both human and character entity formats. The safest way to display an email address on a page is to use it as an image or a Flash file. However, with images if you use mailto, the purpose is lost. So a Flash file would be the best.
Update: Google search engine can now read flash files so I guess spambots would be able to read these too (if not now then sometime in the near future).
So what are you left with? - Use HTMl forms and server-side programming to receive visitor inputs.
An example of munging "user@example.com" via client-side scripting would be:What is 'spam' and how to they get your email from a web page?
SPAM is unsolicited email. It's something you never asked for and most of the times, it's garbage!When you include a mailto tag in a web page, you expose your email to spammers. Getting an email address from a mailto tag is quite easy. You would have noticed that email addresses follow a set format. Spambots are spider like programs that move around on the internet checking HTML documents for this format. When they find it, they extract the email address and store it for their diabolical needs.
But there is a way to fool spambots. If you write the email address as a series of special characters, instead of alphabet, it's highly unlikely that spambots would be able to pick it up.
Each lowercase alphabet has a corresponding special character that we call a Character Entity. In addition to lowercase alphabet, there are special characters for @, the underscore, the period and the hyphen. You can find the full list of HTML Special Characters of Character Entities in the Web Design section.
Each special character starts with an ampersand sign, followed by a hash, then a specific numeric value and ends with a semicolon. Thus, the special character for a is a for b is b and so on.
Now if you have an email address like bard@somewhere.com, you should write it as a series of special characters:
bard@somew
mere.com
This looks really messed up.. but that's the price you have to pay to protect yourself from spam.
However, the above method is not foolproof. Addition of a few lines of code to the spambot can ensure that the script searches for email addresses in both human and character entity formats. The safest way to display an email address on a page is to use it as an image or a Flash file. However, with images if you use mailto, the purpose is lost. So a Flash file would be the best.
Update: Google search engine can now read flash files so I guess spambots would be able to read these too (if not now then sometime in the near future).
So what are you left with? - Use HTMl forms and server-side programming to receive visitor inputs.
< (remove this text)script type="text/javascript">
var name = 'user';
var at = '@';
var domain = 'example.com';
document.write(name + at + domain);
You can also use the context menu by right-clicking on the page that you wish to test and selecting “Open SQL Inject Me Sidebar”. 
All the forms in your current web page will appear in a series of tabs in the sidebar, and each tab will have all the corresponding visible and hidden fields listed. 
The current value for each field will appear with a corresponding combo box. You can change the values directly in this combo box. The default value is the current value of that field, or if none is specified then you will see the string “Change this to the value you want tested” (as shown for the “keywords” field in the above example). If you check the box next to a field name, then that field will be tested for SQL injection. If the box is not checked, then the field will not be tested for SQL Injection and the current value listed in the combo box will be submitted every time. SQL Inject Me works by testing each checked value one at a time. In the above example, the tool would attempt to test the “keywords” field and then the “searchType” field for SQL Injection. The parameters for the submission would look something like: keywords=SQLInjection_ATTACK_STRING&searchType=web when the “keywords” field is being tested and keywords=&searchType= SQLInjection_ATTACK_STRING when the “searchType” field is being tested. The tool will substitute SQLInjection_ATTACK_STRING with the list of strings specified in the options. This is called “fuzzing” in application testing terminology. You can choose to fuzz all the attack strings by selecting the “Run all tests” option and pressing execute, or you can choose to fuzz a few of them by selecting the “Run top X attacks” option and pressing execute. Running all tests with the default list of attack strings can be very time consuming if the server responses are not instant or if there are several fields to be tested. Running the top attacks is usually not as thorough but generally allows you to test much quicker, depending on how many attacks you specify to be “top attacks” (see “What are the Options” for SQL Inject Me below). There are also options at the top of the side bar to “Test all forms with all attacks” and “Test all forms with top attacks”. This will automatically test every field in every form with either all attack strings or the Top X attacks. If you select this option then the checkboxes next to field names will be ignored. 
For each field the following details are given: Form state Values of all other parameters during submission of the form Result details Individual failures, warnings and passes including the test value that lead to that individual result. This information is important in determining how a particular field may be vulnerable; you can take any of the test values that resulted in a failure and write your own injection string to manually verify. 
