Invisible Mailto:

This is a demonstration of a sneaky way some web sites might try to get your email address. Depending on the browser & mail client you are using, and the security setting the browser is set for, you might get a warning message about sending unsecured form information. Or your mailer could send a mail without your knowledge... and someone (possibly a spammer) could have your email address.

I am using an  invalid mailto address in the 'invisible form', so should your mailer be set to send without warning (or you choose to OK the warning), it will be returned to you with an invalid address (poremsk@tricon.net) This might be the only way you even know that your mailer is sending mail out without your permission.

How does it work?

When this page is loaded a javascript routine calls the mailer up with an "onload" event. This means when the page is loaded an email is generated,   normally you'd need to hit a submit button. The only clue you would have is if your mailer is set to warn about posting form data... but if you had no idea what was going on, you might be confused and OK it. (Windows gives us messages all the time with OK or cancel and we usually OK them all, right?)

Then, depending on your mailer, either the mail would be sent directly to the outbox without further intervention (Netscape 3) or the new message form would be waiting for you to send it to the outbox (Outlook). If using a mailer that acts as outlook does, you'd see that a mail was generated and could cancel it. (These are the only 2 mailers I've tested.)

View the source to see code used.

What can you do?

So how can you protect your email address? Set your browser to warn before posting data. Tools > options in Internet explorer or network options in Netscape. In fact, all your security settings should be medium or high. If using Netscape 3 you might want to consider switching to a more secure mailer... one that doesn't automatically send mail to the outbox, but requires you to hit a "send" button.

Turning off JavaScript capabilities would also work, but then you'd lose some useful effects of JavaScript.

Should you use this code to find out who visits your site?

NO! There is nothing that will gain you the hatred of the masses faster than collecting email addresses... Don't even think of doing this to gain addresses for sending spam or selling the addresses to spammers. If you want to send mail to your visitors -- ask them to fill in a form and give it to you, if they so desire. Don't "steal" their address without their knowledge.