Modify incart.asp to stop spam cart

Author	Topic »
Marshall Ecommerce Template Guru USA 2004 Posts	Posted - 08/24/2026 : 15:30:26 ASP V7.7.8 Not a site easily updated. I have a customer getting a lot of spam orders from literally all over the world. The one thing they have in common is the 'ordAddInfo' field always has "Thank you for your order." without the quotes. So I modified the inc/incart.asp file FROM if orderid="" AND (in_array(lcase(ordEmail),bad_emails,TRUE) OR ordAddress="3137 Laguna Street") then sSQL="DELETE FROM cart WHERE cartCompleted=0 AND cartOrderID=0 AND " & getsessionsql() ect_query(sSQL) success=FALSE end if TO THIS if orderid="" AND (in_array(lcase(ordEmail),bad_emails,TRUE) OR ordAddress="3137 Laguna Street" OR ordAddInfo="Thank you for your order.") then sSQL="DELETE FROM cart WHERE cartCompleted=0 AND cartOrderID=0 AND " & getsessionsql() ect_query(sSQL) success=FALSE end if As expected an ERROR appears when you click for shipping information. However, the order is showing up in the order admin but without any product. Normally, the order does not show up in the order admin as with 'bad_emails' array, so I suspect I am missing something like needing to add to this array: errordname=FALSE : errordaddress=FALSE : errordcity=FALSE : errordstate=FALSE : errordshipstate=FALSE : errordcountry=FALSE : errordzip=FALSE : errordphone=FALSE : errordemail=FALSE : errordemailv=FALSE : errorordAddInfo=FALSE : errtermsandconditions=FALSE : errordshipaddress=FALSE : errordshipcountry=FALSE Any assistance would be appreciated. Marshall CENLYT Productions - ms designs Affordable Web Design Custom Ecommerce Designs Responsive Websites Cenlyt.com
Vince Administrator 43457 Posts	Posted - 08/25/2026 : 11:25:30 Hi Marshall Really, that all looks fine to me so is it possible you had created the order previous to this test? Could you try another browser that you hadn't used before for another test maybe? Vince Click Here for Shopping Cart Software Click Here to sign up for our newsletter Click Here for the latest updater
Marshall Ecommerce Template Guru USA 2004 Posts	Posted - 08/25/2026 : 13:37:32 Are you saying it looks fine that I should add errorordAddInfo=FALSE : to that array as I have not done that yet? But to directly answer your question, yes, I used different browsers before asking the question. I added errordaddinfo=FALSE : to the array at the top and while it is deleting the product and giving an error on the shipping page, the empty order is still showing up in the order admin. Marshall CENLYT Productions - ms designs Affordable Web Design Custom Ecommerce Designs Responsive Websites Cenlyt.com Edited by - Marshall on 08/25/2026 17:20:47
Vince Administrator 43457 Posts	Posted - 08/26/2026 : 02:00:06 Hi Marshall I mean it looks fine without adding anything else. I tried with just the changes you made and tried an order with the additional info that triggers it and I do not get an order created. Have you tried just putting the changes into the site as it may be your test has an order for some reason but in actual practice it works. Just by setting success to FALSE there should bypass all the order creation code. Vince Click Here for Shopping Cart Software Click Here to sign up for our newsletter Click Here for the latest updater
Marshall Ecommerce Template Guru USA 2004 Posts	Posted - 08/26/2026 : 05:35:33 Remember, this is ASP v7.7.8 This is what was there and with it, the bad_email was not working if orderid="" AND (in_array(ordEmail,bad_emails,TRUE) OR ordAddress="3137 Laguna Street") then sSQL="DELETE FROM cart WHERE cartCompleted=0 AND " & getsessionsql() ect_query(sSQL) success=FALSE end if So I looked at a newer version and saw this change in the code (lcase(ordEmail),bad_emails,TRUE) So I copied the new code, adding the "Thank you..." if orderid="" AND (in_array(lcase(ordEmail),bad_emails,TRUE) OR ordAddress="3137 Laguna Street" OR ordAddInfo="Thank you for your order.") then sSQL="DELETE FROM cart WHERE cartCompleted=0 AND cartOrderID=0 AND " & getsessionsql() ect_query(sSQL) success=FALSE end if I just noticed this is the new code that was not in the old one AND cartOrderID=0 Would that make any difference? This is a site I had you modify some files, so it is not easily updated. I am going to email you. Marshall CENLYT Productions - ms designs Affordable Web Design Custom Ecommerce Designs Responsive Websites Cenlyt.com Edited by - Marshall on 08/26/2026 05:35:52
Marshall Ecommerce Template Guru USA 2004 Posts	Posted - 08/26/2026 : 11:43:14 PROBLEM SOLVED! I took this from v7.7.8 if orderid="" AND (in_array(lcase(ordEmail),bad_emails,TRUE) OR ordAddress="3137 Laguna Street" OR ordAddInfo="Thank you for your order.") then sSQL="DELETE FROM cart WHERE cartCompleted=0 AND cartOrderID=0 AND " & getsessionsql() ect_query(sSQL) success=FALSE end if if (success OR getpost("shipselectoraction")="") AND NOT stockwarning then And replaced it with this from v7.9.5 if in_array(lcase(ordEmail),bad_emails,TRUE) OR ordAddress="3137 Laguna Street" OR ordAddInfo="Thank you for your order." then if orderid="" then sSQL="DELETE FROM cart WHERE cartCompleted=0 AND cartOrderID=0 AND " & getsessionsql() ect_query(sSQL) end if success=FALSE elseif (success OR getpost("shipselectoraction")="") AND NOT stockwarning then Works perfectly now. Thanks for your help Vince. Marshall CENLYT Productions - ms designs Affordable Web Design Custom Ecommerce Designs Responsive Websites Cenlyt.com
Vince Administrator 43457 Posts	Posted - 08/27/2026 : 01:57:28 Well done Marshall and thanks for letting us know! Vince Click Here for Shopping Cart Software Click Here to sign up for our newsletter Click Here for the latest updater
	Topic »