Form fill out empty, despite required fields?

[Anonymous]

In the last month or so, I've seen about 3 "leads" come into the system through a basic MKTO form on our website ("Contact form")... when this happens, an alert is triggered so we're notified immediately and can reach out to them. All of the fields on this form are required. However, what's interesting, is that somehow, the form is being submitted without ANY information being entered.... so when we get an alert, the information in the alert just highlights the "default" data for that field (which is "Not Provided"). I go and look at these leads and indeed, somehow they've entered the system through a form fill-out with required fields... but without giving us any information.

Any ideas?

[Anonymous]

Simple explanation, valid for Marketo forms and almost all forms out there: modern applications rely on JavaScript for field and form validation, effectively moving that workload to the browser, reducing the strain on the server.

Disabling JavaScript at browser level means all validation rules are no longer executed therefore the form can be submitted without any information. Users have that ability. It is beyond the reach of web applications.

The solution is simple: add the noscript tag, redirectling to an invalid URL, discouraging users (mostly spammers) trying again.

I would suggest adding noscript to Landing Page Options - Edit Page Meta Tags - Custom Head HTML
You can use a real URL, say, the homepage, or to really disperse spammers, send to an invalid location to force a HTTP 404, very annoying to robots:

<noscript>Please enable JavaScript!

<META HTTP-EQUIV="Refresh" CONTENT="0;URL=http://bye_spammer">

</noscript>

Reference

http://www.w3schools.com/tags/tag_noscript.asp

[Anonymous]

Do you have progressive profiling enabled on this form?  I have run into issues where a lead may have been using a public computer and entered in their data.  And then a new person comes to the same form, and it is showing the additional progressive profiling fields and whatever required fields you have.  This will allow the new lead to submit the form and not ever see the original form fields.  I hope that makes sense.

[Anonymous]

Thanks guys!

I think the first answer may be the ticket... I'm gonna look into applying that approach first.

Kenny, your idea does make sense but, alas, this specific form doesn't have progressive profiling enabled, so I don't think that's the dilemma in this specific case. Good thought though!

Appreciate you jumping in with thoughts! - Jen

[Anonymous]

Breno - Quick follow-up question:

 
We applied this fix, but when we tested it - disabled Javascript on our browser and tried to click any link on the page it wouldn’t do anything, wouldn’t link to the next page or refresh. It basically acted like a dead link. Curious - does the Munchkin code convert all links on our page to be run by Javascript? This is probably okay as I’m sure a mass majority of our visitors have Javascript enabled by default, but for those who DO turn off javascript for security reasons... they won't have any way to navigate our site. Is there a solution or work-around for that?

[Anonymous]

Unless the links are defined by JavaScripts they should remain active.

Clearing cache and cookies or using a different browser can eliminate an obscure caching problem.

Please let me know the landing page name if the problem persists.

[Anonymous]

Based on the below alert sent out earlier today, I'm guessing I'm not the only person that this is happening to... unless this is an isolated event that's occuring for a different reason that the spam issues Marketo is seeing?:

"We are experiencing a high volume of spam-submissions through forms. Our engineering team is aware of this issue and is currently working to resolve. Following the resolution of this issue we will publish instructions on how best to scrub these false leads from your database. We are experiencing a high volume of spam-submissions through forms. Our engineering team is aware of this issue and is currently working to resolve. Following the resolution of this issue we will publish instructions on how best to scrub these false leads from your database...."

[Anonymous]

Jen, you are right regarding today's occurrence. Last week's might be an early symptom. Hopefully the freshly solved P1 posted as alert will solve the problem you are facing otherwise I will be glad to investigate the problem if the instance was deliberately targeted by spmabots.