Encode emails in select drop-downs to prevent email harvesting

+2 Works well and using this on our sites without incident.

This looks interesting and promising. Does this also fix #282436: Multiple Options, Same Value in 'Select' Form Element (+ Protect from Spam Harvesters) if encoding the values?

+1 subscribe

Where does this patch go, please?

Was this ever considered for incorporating into the Webform code? Seems like it's a worthwhile addition.

I would prefer a solution with simple numbers instead of hashing.
Just add a checkbox "use numbers as option keys on client side" to the settings for a multichoice field. We don't need an additional table to store the mapping, it can simply be stored in the form array (not accessible on client side).

I'm moving this to the 3.x branch as new features are no longer being added to the 2.x branch. The 3.x branch has a very different way of handling e-mails that might make it much more feasible to implement a contact.module-like approach, where the e-mails are not part of the list of options at all, but instead tied to the e-mail configuration.

My thoughts on this would be the following workflow:

- Set up a webform with a select list. Give the select list whatever keys you want (or none at all).
- Visit the "E-mail" tab of the Webform configuration, add a new e-mail for the select component.
- Under the select component, enter in e-mails for each value of the select list (multiples or duplicates allowed easily here).

I've set this back to active because it's an entirely different approach than the current patch.

We'll merge this with #282436: Multiple Options, Same Value in 'Select' Form Element (+ Protect from Spam Harvesters) again so I don't have to keep track of 2 issues.

I decided to not encode emails but rather insert something like "..._at_" at the end because all my recipients are in the same domain. So, I made a little module based on discussions here, and in setup of this module you need to insert mask and domain then use that defined mask everywhere in keys and it will be automatically replaced with domain. Maybe someone would like to try it.