Since several years I run a Drupal 7 web site - as a frontend to a multi-player card game.

I have the following SPAM protection at my web site: the new users should specify their gender at the registration (it should be "Male" or "Female", but not the default "Robot") and then they have to play the card game:


Every night I run a cronjob, which deletes users who have wrong gender or who have registered 10 days ago and still haven't played:

delete from drupal_users
where uid <> 0 and
to_timestamp(created) < (now() - interval '10 day') and
uid not in (select distinct id from pref_money); /* haven't played the game */

This does work well, BUT recently the amount of registering fake users has increased to hundreds per hour and my site keeps sending lots of registering mails (which bounce then to my poor mailbox) every minute.

So my question is: how NOT to send the registration mail to users who have their gender set to "Robot"?

Here is what I have found sofar:

1) The gender (an additional field at my reg. form) can be found the following way:

        $result = db_query('select field_gender_value from {field_data_field_gender} where entity_id=:id', array(':id' => array($viewer_id)));
        $gender = $result->fetchField();
        if ('Robot' == $gender) {

2) And I probably should provide a hook_mail_alter in my custom module:

function MY_CUSTOM_MODULE_mail_alter(&$message) {
  # XXX how to find gender here?
  if ('Robot' == $gender) {
      # XXX how to abort mailing for registration only?
      $message['send'] = FALSE;

But in 2) I don't know 2 things - how to find the gender value there and how to cancel the registration mails only?

Any suggestions please?

Please do not suggest the Mollom module or any standard Drupal anti-spam measures, because my question is very specific.

  • mail_alter only has access to the message. Is the gender information part of it?
    – Letharion
    Nov 18, 2013 at 14:38
  • No and that is my problem - how to find the gender (an additional field in registration form) from the hook_mail_alter? Nov 18, 2013 at 14:39
  • @AlexanderFarber Does $message contain a reference to the related user account?
    – Clive
    Nov 18, 2013 at 14:42
  • I don't know, that is why I am asking the Drupal experts here :-) Nov 18, 2013 at 14:44
  • Ah ok - it would be much easier (and quicker) for you to check that yourself than wait for someone here to set up a test and do it. If you don't already have it, install the Devel module, and add dpm($message); to the mail alter hook. Then invoke the email you're trying to catch into sending, and a message will appear on screen containing all the contents of $message
    – Clive
    Nov 18, 2013 at 14:46

1 Answer 1


I suggest you implement hook_form_id_alter to either add a new validation function to the registration form, or replace the submit callback.

In a validation function, you have access to the form values, and you can do whatever checks you want, and fail the submission. This will reject the form all together.

If you replace the submit callback instead, you could override only the sending of the e-mail. but otherwise let the form pass through, which seems closer to what is being asked for.

  • Do you suggest to modify modules/user/user.module? Which method there? I'd like to change user_validate_mail - but how to find the gender field value there? Nov 18, 2013 at 15:04
  • This is the best approach, but I would add an additional validation handler instead of replacing the submit function.
    – mpdonadio
    Nov 18, 2013 at 15:15
  • Additional validation handler does sound better, I'll update with that.
    – Letharion
    Nov 18, 2013 at 15:18
  • Idea is nice, but rejecting the form for bot will tell him he failed. So it's good idea to not highlight the field that failed. With CAPTCHA it's OK as it is supposedly unsolvable anyway, but here it would just tell bot to select another option and try again. Of course only smarter bots will ever try, but their number is growing.
    – Mołot
    Nov 21, 2013 at 14:35
  • Yeah, I thought of that as well, which is why I ended up keeping the submit option in there as well. Overriding the submit one can still fake a successful POST.
    – Letharion
    Nov 21, 2013 at 17:06

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.