OK, here is a complete contact page that I knocked up recently. Not the tightest bit of coding cos I did it in a rush as a freebie for a friend. It includes the js for page validation, the php validation in case js is off and the error reporting when that happens. It also refs functions for defending against spam exploits which I've posted at the bottom.
Oh yes, the $vals array is used to store and redisplay user input.
<?php // contact.php
require_once('includes/header_no_session.php');
require_once('includes/head1.php');
?>
<script type="text/javascript">
function EmailChecker() {
if (document.contactform.name.value == ""){
alert("Please enter your Name");
document.contactform.name.focus();
return false;}
else
{
if (document.contactform.company.value == ""){
alert("Please enter your Company Name");
document.contactform.company.focus();
return false;}
else
{
if (document.contactform.phone.value == ""){
alert("Please enter your Telephone Number");
document.contactform.phone.focus();
return false;}
else
{
if (document.contactform.email.value == ""){
alert("Please enter your Email Address");
document.contactform.email.focus();
return false;}
else
{
if (!document.contactform.email.value.match(/^[a-z0-9]+[_.a-z0-9-]+@[a-z0-9-]+\.+[a-z0-9.-]+$/i)){
alert("Your email address appears to be invalid.");
document.contactform.email.focus();
return false;}
else
{
document.contactform.submit()
}
}
}
}
}
}
</script>
</head>
<?php
require_once('includes/body1.php');
$errs = array();
$vals = array('name'=>'', 'position'=>'', 'company'=>'', 'address'=>'', 'town'=>'', 'postcode'=>'', 'phone'=>'', 'email'=>'', 'enquiry'=>'');
if (isset($_POST['submit'])) {
// check for wrong referer - assume spam attack and abort
if (($_SERVER['HTTP_REFERER'] != 'http://integralcm.com/contact.php') and ($_SERVER['HTTP_REFERER'] != 'http://www.integralcm.com/contact.php' )) {
die;
}
// store the form data for verification and redisplay
foreach($_POST as $k=>$v) {
$vals[$k] = $v;
}
// validate fields in case user has js turned off
if (empty($vals['name'])) {
$errs[] = '<em>Name is a required field</em>';
}
if (empty($_POST['company'])) {
$errs[] = '<em>Company Name is a required field</em>';
}
if (empty($_POST['phone'])) {
$errs[] = '<em>Phone is a required field</em>';
}
if (empty($_POST['email'])) {
$errs[] = '<em>Email is a required field</em>';
}
// if required fields are there check contents of all fields for spam attack
// and send email if OK then inform user
if(count($errs)==0) {
require('php/funkybass.php');
$spam = '<div><span style="color:red"><h4>SPAM exploit attack detected and rejected</h4></span></div>';
foreach($_POST as $k=>$v) {
if ($k == 'enquiry') { // textarea
if (!has_no_emailheaders($v)){
print($spam) ;
die();
} else {
$message .= '\n\n--- Comments --- \n' . stripslashes(wordwrap($v, 70)) . "\n";
}
} else {
if (!has_no_newlines($v)){
print($spam) ;
die();
}
if (!has_no_emailheaders($v)){
print($spam) ;
die();
}
switch ($k) {
case 'submit':
break;
case 'brochure':
$message .= "\n*** Brochure Requested ***\n\n";
break;
default:
$message .= $k . ' = ' . $v . "\n";
}
}
}
// got this far then send email and terminate processing
$to = 'a.brennan@integralcm.com';
$subject = 'ICM Contact Form';
$headers = 'From: postmaster@integralcm.com' . "\n" . 'X-Mailer: PHP/' . phpversion();
$sm = mail($to, $subject, $message, $headers);
// check sendmail was ok and inform user accordingly
if ($sm) {
echo '<div id="content">
<img src="images/thankyou1.jpg" alt="Contact processed successfully" />
<h3>Thank you for your communication.</h3>
<h3>A member of our staff will contact you in the near future.</h3>';
// now break out of the page
exit;
} else {
echo '<div id="content">
<img src="images/contacterror1.jpg" alt="There was an error" />
<h3>We are sorry but there has been an error processing your communication.</h3>
<h3>Please go back and try again.</h3>
<p>Alternatively, you can use the contact information on the left.</p>
<p>We apologise again for the problem and hope that it has not cause you too much trouble.</p>';
// now break out of the page
exit;
}
}
// end of form submission processing
}
?>
<div id="content">
<img src="images/contact1.jpg" alt="Contact Form" />
<h3>Please fill in the form below and we will contact you as soon as possible.</h3>
<div id="contactform" >
<form id="contactform" name="contactform" method="post" action="<?php $_SERVER['PHP_SELF'] ?>" >
<fieldset>
<?php
if(count($errs)>0) {
foreach($errs as $v) {
echo $v . '<br />';
}
} else {
echo '<em>*</em> Indicates a compulsory field ';
}
?> <br />
<fieldset id="cf1">
<label for="name" >Name <em>*</em> :</label>
<input type="text" name="name" id="name" tabindex="1" value="<? echo $vals['name']; ?>" />
<br />
<label for="position" >Position :</label>
<input type="text" name="position" id="position" tabindex="2" value="<? echo $vals['position']; ?>" />
<br />
<label for="company" >Company Name <em>*</em> :</label>
<input type="text" name="company" id="company" tabindex="3" value="<? echo $vals['company']; ?>" />
<br />
<label for="address" >Address :</label>
<input type="text" name="address" id="address" tabindex="4" value="<? echo $vals['address']; ?>" />
<br />
<label for="town" >Town :</label>
<input type="text" name="town" id="town" tabindex="5" value="<? echo $vals['town']; ?>" />
<br />
<label for="postcode" >Post Code :</label>
<input type="text" name="postcode" id="postcode" tabindex="6" value="<? echo $vals['postcode']; ?>" />
<br />
<label for="phone" >Phone <em>*</em> :</label>
<input type="text" name="phone" id="phone" tabindex="7" value="<? echo $vals['phone']; ?>" />
<br />
<label for="email" >Email <em>*</em> :</label>
<input type="text" name="email" id="email" tabindex="8" value="<? echo $vals['email']; ?>" />
</fieldset>
<fieldset id="cf2">
<label for="enquiry" >Comments :</label>
<br />
<textarea name="enquiry" cols="30" rows="8" id="enquiry" tabindex="9"><? echo $vals['enquiry']; ?></textarea>
<br />
<label for="brochure" >Please send me a brochure</label>
<input type="checkbox" name="brochure" id="brochure" tabindex="10" <? if($vals['brochure']) { echo 'checked="checked"'; } ?> />
<br />
<div class="c">
<button name="submit" id="submit" onclick="EmailChecker(); return false;" >Send Your Enquiry</button>
</div>
</fieldset>
</fieldset>
</form>
</div> <!-- end of div contactform -->
</div> <!-- end of div content -->
<?php
require_once('includes/foot1.php');
?>
<?php // funkybass.php
// Remove any newlines from input email address to protect against mail form exploits by spammers
function has_no_newlines($text)
{
return preg_match("/(%0A|%0D|\\n+|\\r+)/i", $text) == 0;
}
// Remove any email headers from mail form input to protect against mail form exploits by spammers
function has_no_emailheaders($text)
{
return preg_match("/(content-type:|to:|cc:|bcc:)/i", $text) == 0;
}
?>