How do I output a hidden password field as part of Drupal form?

Question

I want to alter an existing Drupal form built with form API to contain a hidden password field. (I.e. I want to create a honeypot field in the form that only 'bots will see and fill in, while humans will leave this field it empty).

The HTML I want included in the form shall be something like this:

<input type="password" name="password" style="display:none;" />

I've looked at hook_FORM_ID_alter, but so far I haven't seen how it can help me with this.

I think I am looking for a way to theme this particular field, some way to manipulate the HTML after it has been rendered, but before it shown to the human (or 'bot), but I am open for other answers as well.

(For what it is worth: I am using Drupal 7.)

Answer 1

If you don't want Honeypot module as mentioned by Jimajamma, you can do it with Form API #attributes all right:

$form['pass'] = array(
  '#type' => 'password',
  '#title' => t('Password'),
  '#maxlength' => 64,
  '#size' => 15,
  '#attributes' = array('style' => array('display:none;'));
);

Of course it's easy to catch display:none in bot's code. It's also common and not so much harder to find out that class applied is styled with it in CSS. There are two methods that are not yet so easy to catch:

• Using box model and overflow to make element hidden under other HTML boxes.
• JavaScript code to move it out of sight or apply display: none to it

In both cases you shouldn't use obvious identifiers in html, like .honeypot or .hidden, as this will be probably easily found by the bot, too. Also, z-index usually isn't the way to go, as it tells bot "this element is under other one", or "this element is over other one, hides something".