feedback form

[DavidHopkins]

Hey guys, I'm new here but have doing some basic PHP for a while now.

I use an HTML form that links to a PHP page which then processes the details and send an email. However, I've been getting a lot of spam as a result of this and need to know how I can modify it so this stops, or at least the form/processing is safer and stops it in future.

This is the code I use in the PHP page;

<?php
//start building the mail string
$msg = "Name:  $_POST[name]\n";
$msg .= "Email:  $_POST[email]\n";
$msg .= "Company:  $_POST[company]\n";
$msg .= "Contact Number:  $_POST[contact_number]\n";
$msg .= "Contact Address:  $_POST[contact_address]\n";
$msg .= "Enquiry:  $_POST[enquiry]\n";
$msg .= "How did you find us:  $_POST[find_us]\n";
$msg .= "other:  $_POST[find_us_other]\n\n";
//set up mail
$recipient = "email@address";
$subject = "Enquiry from Website contact form";
$mailheaders = "From: $_POST[email] \n";
$mailheaders .= "Reply-To: $_POST[email]";
//send mail
mail($recipient, $subject, $msg, $mailheaders);
?>

Any ideas please?

[vaaaska]

This is totally insecure...a hack could easily inject all kinds of stuff in there...

For starters, VALIDATE your inputs so you get only what you expect - you should never be using $_POST data directly. If they are inputting an email address be sure it's an email address and only one. I also don't see a mechanism to kill the process if they have empty fields (some of them must be required).

So, basically clean/validate all your inputs...make a kill mechanism...and put your actual mail function into another function that it's much less possible to slip an easy injection in there (like from the url)...

[DavidHopkins]

this is kind of what I thought.

I've no idea how to do what you've mentioned, but I'll give it a go.

[dmacman1962]

Hi Dave,

Here are a few samples I use on our forms. They are not perfect and I am sure they can be improved.

Emal Sample

if (! ereg('[A-Za-z0-9_-]+\@[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+', $EmailAddress))
{
die("<p align='center'><font face='Arial' size='3' color='#FF0000'>You did not enter a valid email address.<br>Please use the 'Back' button to correct this entry.</font></p>");
}

Ensure that at least 1 checkbox is selected in a group (for required check boxes)

if(!isset($_POST['GradeLevel'])) { // You did not select any boxes
 	$_POST['GradeLevel'] = array();// Make it an array
    die("<p align='center'><font face='Arial' size='3' color='#FF0000'>You did not select a Grade Level Taught. <br>Please hit the back button and choose a Grade Taught.</font></p>");  // Go back
} else {
foreach ($_POST['GradeLevel'] as $grade) { //Set the elements in the array
	$GradeLevel7 = $grade[0];
	$GradeLevel8 = $grade[1];
	$GradeLevel9 = $grade[2];
	$GradeLevel10 = $grade[3];
	$GradeLevel11 = $grade[4];
	$GrageLevel12 = $grade[5];
   	 }
} 

Check last name lto make sure it is at least 2 characters long

if (strlen($LastName) <2)
{
die("<p align='center'><font face='Arial' size='3' color='#FF0000'>You did not enter your last name.<br>Please use the 'Back' button to correct this entry.</font></p>");
}

Hope this helps,

Don

[DavidHopkins]

Thanks.

I'm trying this one out at the moment, but will also give yours a go too;

http://www.php-mysql-tutorial.com/form-validation-with-php.php

[Weedpacket]

dmacman962 wrote:

Here are a few samples I use on our forms. They are not perfect and I am sure they can be improved.

One point of improvement I can see is that your email validator doesn't allow [e-mail] because of the '.' in the mailbox name, nor does it allow [e-mail] because that has two '.' on the right.

Then again, to allow full RFC2822 validation (comments, real names, IPv4/v6 addresses, etc.) the expression would be a lot hairier!