I did a search right after posting and found substr_count which I used to accomplish what I wanted. Any drawback to that function?

In looking at all the spam that has come in this way this week, only two messages contain 3 or less http links.

I don't have any ideas right now on how to block everything. Those two messages did include HTML, so if I did a search for HTML tags I could also cut those out I suppose.

Bruno