Can spams see/use javascript?

Question

My question is obvious. Can spams (I mean blog spams) make use of javascript on my site?

For example "Laravel" needs csrf code on forms. If I pass csrf code as a javascript variable and append the code using jquery append method into the form, will spams be able to submit the form?

Answer 1

Of course, as the source code is on the client side, they can either run it, alter it before running it, or reverse engineer it and populate the form field with the required value directly. That's why any spam protection mechanism always need a server side parte. Otherwise you're just making it harder to break... That said, think if the result is worth the effort to reverse engineer your spam protection.

Answer 2

So, our company has been developing anti-spam for websites and I can say that many spambots(about 30%) are able to use javascript.