Secure mailscript?

[enjoiskater]

Hello,

Okey, now I have been sitting for hours trying to make a secure mailscript with a CAPTCHA function but I can´t do it. So I really need some help now, the form is for a competion that is going to be on my website so I would really like some help.

Here is the form code:

          <form name="kontakt" method="post" action="formmail.php">
          <p><b>Förnamn och efternamn:</b><br>
          <input name="name" type="text" size="30">
          <input name="subject" type="hidden" type="text" size="30" value="Tävling">
          </p>
          <p><b>E-post:</b><br>
          <input name="email" type="text" size="30"> 
          </p>
          <type="hidden" textarea name="message"></textarea>
          <p><b>Vilken av dessa karaktärer spelar man som i Metal Gear Solid 4: Guns of the Patriots?</b><br />
          <input type="radio" name="Svar1" value="Solid Snake"> Solid Snake<br>
          <input type="radio" name="Svar1" value="Liquid"> Liquid<br>
          <input type="radio" name="Svar1" value="Raiden"> Raiden 
          </p>
          <p><b>Vad heter mannen bakom Metal Gear Solid spelen?</b><br />
          <input type="radio" name="Svar2" value="Roman"> Shigeru Miaymoto<br>
          <input type="radio" name="Svar2" value="Colman"> Hideo Kojima<br>
          <input type="radio" name="Svar2" value="Misty"> Tobias Johansson
          </p>
          <p><b>Vilken spelsida gillar du bäst?</b><br />
          <input type="radio" name="Svar3" value="Svart"> Spelkontroll<br>
          <input type="radio" name="Svar3" value="Vit"> Spelkontroll<br>
          <input type="radio" name="Svar3" value="Svart"> Spelkontroll<br>
          </p>
          <p>
          <input name="submit" type="submit"
          value="Skicka meddelandet">
          </p>
          </form>

And here is the code to mail the form info:

<?php

// anger en variabel som kan lagra de eventuella felaktigheterna
$errors = array();

// kontrollera om ett Namn angivits
if (!$_POST["name"])
$errors[] = "- ditt namn";

// kontrollera om ett Ã&#132;mne angivits
if (!$_POST["subject"])
$errors[] = "- Ärende i ämnesraden";

// kontrollera om en Epostadress angivits
if (!$_POST["email"])
$errors[] = "- din epostadress";

// om felaktig information finns visas detta meddelande
if (count($errors)>0){
echo "<strong>Följande information måste anges innan du kan skicka formuläret:</strong><br />";
foreach($errors as $fel)
echo "$fel <br />";
echo "<br />Ange den information som saknas och skicka formuläret igen. Tack! <br />";
echo "<a href='javascript:history.go(-1)'>klicka här får att komma tillbaka till formuläret</a>";
}

else {
// formuläret är korrekt ifyllt och informationen bearbetas
$to = "[e-mail]";
$from = $_POST["email"];
$subject = $_POST["subject"];
$name = $_POST["name"];
$message = $_POST["message"];
$svar1= $_POST["Svar1"];
$svar2= $_POST["Svar2"];
$svar3= $_POST["Svar3"];

//This bit
$message .= "Vad heter huvudpersonen i GTA IV?:".$svar1; 
$message .= "Vad heter huvudpersonen i GTA IV kusin?: ".$svar2; 
$message .= "Vilket färg på din T-Shirt vill du ha?: ".$svar3;


if (mail($to, $subject, $message, "From: $name <$from>"))
echo nl2br("<h2>Ditt tävlingsbidrag är inskickat!</h2>
");

else
echo "Det gick inte att skicka ditt meddelande";
}
?>

And I have tried to add a CAPTCHA code but diden´t get it to work but the form works. So if anyone please can help me add a CAPTCHA function so I dont get spammed when I put it on my site that would be lovley. And also if anyone can help me so that it is a Linebreak between this questions in the mail,
$message .= "Vad heter huvudpersonen i GTA IV?:".$svar1;
$message .= "Vad heter huvudpersonen i GTA IV kusin?: ".$svar2;
$message .= "Vilket färg på din T-Shirt vill du ha?: ".$svar3;

Because right know the sit togheter in the mail and it is a little hard to read. 🙂

I have tried to add a CAPTCHA script myself and it looked like this but as I said i diden´t get it to work.

// Form code with CAPTCHA
<?php
  session_start();
?>

<?php
if (empty($_POST)) { ?>
          <form name="kontakt" method="post" action="formmail.php">
          <p><b>Förnamn och efternamn:</b><br>
          <input name="name" type="text" size="30">
          <input name="subject" type="hidden" type="text" size="30" value="Tävling">
          </p>
          <p><b>E-post:</b><br>
          <input name="email" type="text" size="30"> 
          </p>
          <type="hidden" textarea name="message"></textarea>
          <p><b>Vilken av dessa karaktärer spelar man som i Metal Gear Solid 4: Guns of the Patriots?</b><br />
          <input type="radio" name="Svar1" value="Solid Snake"> Solid Snake<br>
          <input type="radio" name="Svar1" value="Liquid"> Liquid<br>
          <input type="radio" name="Svar1" value="Raiden"> Raiden 
          </p>
          <p><b>Vad heter mannen bakom Metal Gear Solid spelen?</b><br />
          <input type="radio" name="Svar2" value="Roman"> Shigeru Miaymoto<br>
          <input type="radio" name="Svar2" value="Colman"> Hideo Kojima<br>
          <input type="radio" name="Svar2" value="Misty"> Tobias Johansson
          </p>
          <p><b>Vilken spelsida gillar du bäst?</b><br />
          <input type="radio" name="Svar3" value="Svart"> Spelkontroll<br>
          <input type="radio" name="Svar3" value="Vit"> Spelkontroll<br>
          <input type="radio" name="Svar3" value="Svart"> Spelkontroll<br>
          </p>
          <p>
		<!-- pass a session id to the query string of the script to prevent ie caching -->
		<img src="securimage_show.php?sid=<?php echo md5(uniqid(time())); ?>"><br />
		<input type="text" name="code" /><br />           

          </p>
          <p>
          <input name="submit" type="submit"
          value="Skicka meddelandet">
          </p>
          </form>
<?php
} else { //form is posted
  include("securimage.php");
  $img = new Securimage();
  $valid = $img->check($_POST['code']);

  if($valid == true) {
    echo "<center>Thanks, you entered the correct code.</center>";
  } else {
    echo "<center>Sorry, the code you entered was invalid.  <a href=\"javascript:history.go(-1)\">Go back</a> to try again.</center>";
  }
}

?>

//The code that sends the mail is the same as the one a bit up in this message.

Please help me anyone at all! As I said I have been trying for hours 😕

[igorlopez]

Do you have GD support on your php server?
If so then you should be ready to go.
First error in your Captcha code example(and maybe the only one) is that you need to remove the first line, i.e change

// Form code with CAPTCHA
<?php
  session_start();
?>

To:

<?php
  session_start();
?>

This takes care of the session error you must have gotten. And please when you have problems try to be as precise as possible what errors you are getting.

Second error is maybe not an error depending on where you put the secureimage files. On my test server i extracted them onto the webroot so they ended up inside ./secureimage/ hence my code ended up as:
HTML part:

<img id="captcha" src="/securimage/securimage_show.php" alt="CAPTCHA Image" />
<input type="text" name="code" size="10" maxlength="6" />

and the php part

<?php
} else { //form is posted
  include $_SERVER['DOCUMENT_ROOT'] . "/securimage/securimage.php";
  $img = new Securimage();
  $valid = $img->check($_POST['code']);

And this worked like a charm.

One last programming note is that it is actually easier to write your comments in English instead of Swedish just in cases like this where you want help from others that most of the time don't understand Swedish.
With that said... Så önskar jag dig lycka till..

[enjoiskater]

Thanks! And I´m going to follow your advice and start write my comments in english🙂

But I still actully got a problem. The image and everything is showing but if I write the wrong letters in the box it my code still sends my mail. I even can skip to write anything in the CAPTCH box and it still sends my mail. Do you know whats wrong then?😕 That was actully the problem from the start but I explained it pretty bad. Sorry about that.

This is the code for the form now that I changed it:

<?php
  session_start();
?> 

<?php
if (empty($_POST)) { ?>
          <form name="kontakt" method="post" action="formmail.php">
          <p><b>Förnamn och efternamn:</b><br>
          <input name="name" type="text" size="30">
          <input name="subject" type="hidden" type="text" size="30" value="Tävling">
          </p>
          <p><b>E-post:</b><br>
          <input name="email" type="text" size="30"> 
          </p>
          <type="hidden" textarea name="message"></textarea>
          <p><b>Vilken av dessa karaktärer spelar man som i Metal Gear Solid 4: Guns of the Patriots?</b><br />
          <input type="radio" name="Svar1" value="Solid Snake"> Solid Snake<br>
          <input type="radio" name="Svar1" value="Liquid"> Liquid<br>
          <input type="radio" name="Svar1" value="Raiden"> Raiden 
          </p>
          <p><b>Vad heter mannen bakom Metal Gear Solid spelen?</b><br />
          <input type="radio" name="Svar2" value="Roman"> Shigeru Miaymoto<br>
          <input type="radio" name="Svar2" value="Colman"> Hideo Kojima<br>
          <input type="radio" name="Svar2" value="Misty"> Tobias Johansson
          </p>
          <p><b>Vilken spelsida gillar du bäst?</b><br />
          <input type="radio" name="Svar3" value="Svart"> Spelkontroll<br>
          <input type="radio" name="Svar3" value="Vit"> Spelkontroll<br>
          <input type="radio" name="Svar3" value="Svart"> Spelkontroll<br>
          </p>
          <p>
		<!-- pass a session id to the query string of the script to prevent ie caching -->
		<img src="securimage_show.php?sid=<?php echo md5(uniqid(time())); ?>"><br />
		<input type="text" name="code" /><br />           

          </p>
          <p>
          <input name="submit" type="submit"
          value="Skicka meddelandet">
          </p>
          </form>
<?php
} else {  //form is posted
  include $_SERVER['DOCUMENT_ROOT'] . "securimage.php";
  $img = new Securimage();
  $valid = $img->check($_POST['code']);

  if($valid == true) {
    echo "<center>Thanks, you entered the correct code.</center>";
  } else {
    echo "<center>Sorry, the code you entered was invalid.  <a href=\"javascript:history.go(-1)\">Go back</a> to try again.</center>";
  }
}

?>

And the code to send the mail is still the same. 🙂

[igorlopez]

OK, so the Captcha works. That is all well.
What it now boils down to is how your script which sends the mail is included?
One way is of course to just put that part after the post check

} else {  //form is posted
  include $_SERVER['DOCUMENT_ROOT'] . "securimage.php";
  $img = new Securimage();
  $valid = $img->check($_POST['code']);
  $errors = array();
  // kontrollera om ett Namn angivits
  if (!$_POST["name"]) 
   $errors[] = "- ditt namn";

  // kontrollera om ett Ämne angivits
  if (!$_POST["subject"])
    $errors[] = "- Ärende i ämnesraden";

  // kontrollera om en Epostadress angivits
  if (!$_POST["email"])
    $errors[] = "- din epostadress";

  if($valid == true && count($errors)<=0) {
    echo "<center>Thanks, you entered the correct code.</center>";
    // formuläret är korrekt ifyllt och informationen bearbetas
    $to = "[e-mail]";
    $from = $_POST["email"];
    $subject = $_POST["subject"];
    $name = $_POST["name"];
    $message = $_POST["message"];
    $svar1= $_POST["Svar1"];
    $svar2= $_POST["Svar2"];
    $svar3= $_POST["Svar3"];

//This bit
$message .= "Vad heter huvudpersonen i GTA IV?: $svar1\n"; 
$message .= "Vad heter huvudpersonen i GTA IV kusin?: $svar2\n"; 
$message .= "Vilket färg på din T-Shirt vill du ha?: $svar3\n";


if (mail($to, $subject, $message, "From: $name <$from>"))
  echo nl2br("<h2>Ditt tävlingsbidrag är inskickat!</h2>");
else
  echo "Det gick inte att skicka ditt meddelande";
}
  } else {  // I just mangled all faults together, a better handling would be better
    echo "<strong>Följande information måste anges innan du kan skicka formuläret:</strong><br />";
    foreach($errors as $fel)
      echo "$fel <br />";
    echo "<br />Ange den information som saknas och skicka formuläret igen. Tack! <br />";
    echo "<a href='javascript:history.go(-1)'>klicka här får att komma tillbaka till formuläret</a>";
    echo "<center>Sorry, the code you entered was invalid.  <a href=\"javascript:history.go(-1)\">Go back</a> to try again.</center>";
  }
}

I have not tested this script but you get the idea. Also I added the newline char to your mail message.