In good design terms, they really should be avoided for many reasons. If you want to protect web forms from spambots you should employ a honeypot technique. It’s almost always 100% effective, requires no extra steps for the user, isn’t intrusive, and looks much better.

It’s very simple to implement too. Simply put an empty field in the form, hide it from the user, and when processing the form, if it’s been filled out, reject the form. Spambots can’t tell what fields are required, so they don’t risk being rejected for not filling out all required fields they fill out every field on the form; including the “bait” field. Add in some labling for the blind who surf audibly and you have a polished off honeypot that works better than any other spam solution out there.