Contact page error report

[johnworf]

I have 3 files - no doubt they could be put together...but anyway...
this is the basic contact form with an error report... called contact.php

<?php echo $error ?></span></p>
	    <form action="contact-confirm.php" method="post" id="contact">
          <table width="90%" border="0" cellpadding="3" cellspacing="3" class="tableindent">
            <tr>
              <td><div align="right">Name:</div></td>
              <td><input type="text" name="name" /></td>
            </tr>
            <tr>
              <td><div align="right">Email:</div></td>
              <td><input type="text" name="email" value="" /></td>
            </tr>
            <tr>
              <td align="right" valign="top">Comments:</td>
              <td><textarea name="subject" cols="40" rows="8" id="subject"></textarea></td>
            </tr>
            <tr>
              <td><div align="right"></div></td>
              <td><input type="submit" name="-submit" value=" Submit Message " /></td>
            </tr>
          </table>
        </form>

this is the contact-confirm.php

<?
if (empty($_POST['name'])) $error .= "You didn't give us your name.<br>";
if (empty($_POST['email'])) $error .= "You didn't enter your email address.<br>"; 
if (empty($_POST['subject'])) $error .= "You didn't make any comments or ask a question.<br>";
$str = $text; $text_len = strlen($str); 
if($text_len > 800) { $error .= "Sorry, you have used more than permitted 800 characters in your message. Total was $text_len - please shorten your message.<br>"; }

if($email) {
if(isset($_POST['email']))
{ 
// $email = $email; 
// check to make sure email has been filled out with valid address

if (preg_match('/^[-!#$%&\'*+\\.\/0-9=?A-Z^_`{|}~]+@([-0-9A-Z]+\.)+([0-9A-Z]){2,4}$/i', trim($email))) {
//do nothing the syntax looks good
}
else {$error .= "Your email address has a spelling error<BR>";
}//set error code

// check for valid domain name 
$ok = TRUE; 
$ok = eregi( "^[_.0-9a-z-]+@([0-9a-z][0-9a-z-]+.)+[a-z]{2,3}$", $email,
$check); 
$ok = getmxrr(substr(strstr($check[0], '@'), 1), $dummy); 
if($ok === false) 
{ 
$host = substr($email, strpos($email, '@') + 1); 
if(gethostbyname($host) != $host) 
{ 
$ok = true; 
} 
if ($ok != true) {$error .= "That email address does not seem to be valid - please check<br>"; } 
// end of check 
} 
}} // end of email check 


if($error) { 
include("contact.php"); 
}
else { 
include("contact-success.php"); 
}
?>

and this is the contact-success.php ...where an e-mail is sent to both parties...

<p>Thanks for filling in the form</p>
	    <p>
	      <?php
$email = $_POST['email'];
$title = $_POST['name'];
$subject = $_POST['subject'];
$headers = "From: $email";
$sub = "An www.foobar.com message from $title";
$message .= "
$subject\n\n";

$message2 .= "
Thank you for your email message.
We will respond to it as quickly as we can.
For your reference, the text of your message is added at the end of this email.
Kind regards,
--\n

====================
Your original message was\n
====================\n
$subject\n
";
$headers2 .= "From: [e-mail]\n";
$sub2.="Re: A Message from www.blah.com\n";

?>
        </p>
	    <p>Your message has been sent.</p>
	    <p>We also sent a copy of the message to <nobr><?php print $email; ?>.</nobr></p>
	    <p>If this is not correct, please
	      <script type="text/javascript">
document.write('<a href="javascript:history.go(-1);">go back</a>'); 
          </script>
	      to the contact page and send again. </p>
	    <?php 
$message = stripslashes($message);
$message2 = stripslashes($message2); 
$message = strip_tags ($message);
$message2 = strip_tags ($message2);
mail("[e-mail]", $sub, $message, $headers);
mail($email, $sub2, $message2, $headers2);
?>

my question is how do i put in the contact form a question like what colour is the sun, and if any errors come up rather than list the errors - keep any of the fields that are correct the same so they don't have to retype and put in something where there is an error

[dalecosp]

Since PHP is all server side, you've got to store the values somewhere. The $SESSION array is designed for this, so you'd assign something like this after you check that the POST vars aren't empty:

session_start();
$_SESSION['name']=$_POST['name'];
$_SESSION['subject']=$_POST['subject'];
$_SESSION['email']=$_POST['email'];

Then, back in the form it would look something like:

<?php 
session_start();
echo $error ?></span></p>
        <form action="contact-confirm.php" method="post" id="contact">
          <table width="90&#37;" border="0" cellpadding="3" cellspacing="3" class="tableindent">
            <tr>
              <td><div align="right">Name:</div></td>
              <td><input type="text" name="name" value="<?php echo $_SESSION['name']; ?>"/></td>
            </tr>
     

and so on....

[dalecosp]

Note also that session_start() must be called before any other output.

[coldwerturkey]

is $error defined?

[johnworf]

$error is defined in contact-confirm.php page

[johnworf]

okay dale i'll give that a go...

also i want to add a question to the form to avoid spambots - like what colour is the sun, then obviously if they answer wrong i can take them back to contact.php ?

[Weedpacket]

johnworf wrote:

like what colour is the sun

White, of course 🙂

You can have a look at php.net's source code to see how they protect the "add user note" functionality.
E.g.,
http://www.php.net/source.php?url=/manual/add-note.php
http://www.php.net/source.php?url=/manual/spam_challenge.php
One of the things about it is that the answer is built into the form, avoiding the need to have anything session-based.

[dalecosp]

johnworf;10905513 wrote:

okay dale i'll give that a go...

also i want to add a question to the form to avoid spambots - like what colour is the sun, then obviously if they answer wrong i can take them back to contact.php ?

I made a post earlier today regarding bot blocking techniques that don't use "CAPTCHA" images. It's here. Hope it helps.

[johnworf]

i've just reproduced your comments...some good ideas...

A recent article in c't (a German magazine) condemns CAPTCHAs as too easily foiled by todays bots (with OCR technology) and suggests the following ideas for bot evasion instead:

1. Provide a form input field like "street address" or something similar that you don't actually need, and make it invisible to a legitimate user. Bots tend to fill in ALL fields, so you'd write your handler to reject any forms that contained data in the hidden form field.

2. A similar trick is to hide a form field in an HTML comment; many of the bots tend to ignore comment delimiters as well.

3. A third trick works in the opposite way; use Javascript to create an "on the fly" form field that isn't in the actual HTML output. Most bots tend to not execute Javascript.

4. Beyond that, dynamically created random form fields and cryptographic signatures, time stamps, etc. are more advanced means to bot blocking.

HTH, (and thanks to Olli Fromme for the info)

[johnworf]

Hi dale,

i take it you use

<?php session_destroy(); ?>

after the form?

Also the subject doesn't seem to get filled - the e-mail and name fields worked like a treat but whenever i put anything in the text area and pressed submit - it didn't seem to hold anything?

so my contact.php page now looks like....

<?php
session_start();
echo $error ?></span></p>
	    <form action="contact-confirm.php" method="post" id="contact">
          <table width="90%" border="0" cellpadding="3" cellspacing="3" class="tableindent">
            <tr>
              <td><div align="right">Name:</div></td>
              <td><input type="text" name="name" value="<?php echo $_SESSION['name']; ?>"/></td>
            </tr>
            <tr>
              <td><div align="right">Email:</div></td>
              <td><input type="text" name="email" value="<?php echo $_SESSION['email']; ?>" /></td>
            </tr>
            <input type="hidden" name="address" />
            <tr>
              <td align="right" valign="top">Comments:</td>
              <td><textarea name="subject" cols="40" rows="8" id="subject" value="<?php echo $_SESSION['subject']; ?>"></textarea></td>
            </tr>
            <tr>
              <td><div align="right"></div></td>
              <td><input type="submit" name="-submit" value=" Submit Message " /></td>
            </tr>
          </table>
        </form>
	  </div>
      <?php session_destroy(); ?>

and my contact-confirm.php now looks like..added the session variables in and sorted out the len function and the error if the address is filled in using !empty

just need to sort out why the textarea isn't being filled - any ideas?

<?
if (empty($_POST['name'])) $error .= "You didn't give us your name.<br>";
if (empty($_POST['email'])) $error .= "You didn't enter your email address.<br>"; 
if (empty($_POST['subject'])) $error .= "You didn't make any comments or ask a question.<br>";
if (!empty($_POST['address'])) $error .= "You filled in a field you shouldn't - naughty robot!<br>";
$str = ($_POST['subject']); $text_len = strlen($str); 
if($text_len > 1000) { $error .= "Sorry, you have used more than permitted 1000 characters in your message. Total was $text_len - please shorten your message.<br>"; }

if($email) {
if(isset($_POST['email']))
{ 
// $email = $email; 
// check to make sure email has been filled out with valid address

if (preg_match('/^[-!#$%&\'*+\\.\/0-9=?A-Z^_`{|}~]+@([-0-9A-Z]+\.)+([0-9A-Z]){2,4}$/i', trim($email))) {
//do nothing the syntax looks good
}
else {$error .= "Your email address has a spelling error<BR>";
}//set error code

// check for valid domain name 
$ok = TRUE; 
$ok = eregi( "^[_.0-9a-z-]+@([0-9a-z][0-9a-z-]+.)+[a-z]{2,3}$", $email,
$check); 
$ok = getmxrr(substr(strstr($check[0], '@'), 1), $dummy); 
if($ok === false) 
{ 
$host = substr($email, strpos($email, '@') + 1); 
if(gethostbyname($host) != $host) 
{ 
$ok = true; 
} 
if ($ok != true) {$error .= "That email address does not seem to be valid - please check<br>"; } 
// end of check 
} 
}} // end of email check


session_start();
$_SESSION['name']=$_POST['name'];
$_SESSION['subject']=$_POST['subject'];
$_SESSION['email']=$_POST['email'];


if($error) { 
include("contact.php"); 
}
else { 
include("contact-success.php"); 
}
?>

[johnworf]

how would you put this together in one contact form - contact.php ?

[johnworf]

Hi Dale,

In a similar way to the contact page i wonder if someone could help me....

http://www.phpbuilder.com/board/newreply.php?do=postreply&t=10363401

I've added in a hidden field, but i cannot seem to build up the error checking - it just seems to go straight to the bad robot page!

[dalecosp]

johnworf;10905573 wrote:

Hi dale,

i take it you use

<?php session_destroy(); ?>

after the form?

You could, I suppose upon successful submission.

Also the subject doesn't seem to get filled - the e-mail and name fields worked like a treat but whenever i put anything in the text area and pressed submit - it didn't seem to hold anything?

Well, I didn't notice it was a text area. IIRC, textarea doesn't take a "value", you must do it this way:

<textarea name="foo"><?php echo $somedata; ?></textarea>

That will probably fix ya.

[dalecosp]

johnworf;10905581 wrote:

how would you put this together in one contact form - contact.php ?

If you have 3 scripts to combine into one, you'd put them all in one file and then enclose each script in a conditional test block:

<?php
//bigscript.php

if ($conditions_for_script2_andscript3_not_yet_met) {

   // Script one here

}

elseif ($conditions_for_script2_are_present) {

   // Script two here

}

... and so on. However, keep in mind that you are likely doubling the number of lines of code in one file by adding two scripts together, so it's a bit of a tradeoff. PHP won't care, but you might when you have to read 250 lines of code instead of 125, or what-not.

[johnworf]

Hi Dale,

That's the contact form pretty much sorted now - thanks for that...

on a similar front...basically i want to do the error checking before i send this page to be inserted into the mysql database. Also i want to strip down a field...

when it retrieves the referrer information - sometimes you get ? after the url and missing http: etc. - i want the data to be stripped of http:// and any www. and any rogue ? after the url - how do i do that?

i tried using if statements but it all seemed to go to pot!

<?php require_once('Connections/myconn.php'); ?>
<?php
if (!function_exists("GetSQLValueString")) {
function GetSQLValueString($theValue, $theType, $theDefinedValue = "", $theNotDefinedValue = "")
{
  $theValue = get_magic_quotes_gpc() ? stripslashes($theValue) : $theValue;

  $theValue = function_exists("mysql_real_escape_string") ? mysql_real_escape_string($theValue) : mysql_escape_string($theValue);

  switch ($theType) {
    case "text":
      $theValue = ($theValue != "") ? "'" . $theValue . "'" : "NULL";
      break;    

    case "long":
    case "int":
      $theValue = ($theValue != "") ? intval($theValue) : "NULL";
      break;
    case "double":
      $theValue = ($theValue != "") ? "'" . doubleval($theValue) . "'" : "NULL";
      break;
    case "date":
      $theValue = ($theValue != "") ? "'" . $theValue . "'" : "NULL";
      break;
    case "defined":
      $theValue = ($theValue != "") ? $theDefinedValue : $theNotDefinedValue;
      break;
  }
  return $theValue;
}
}

$editFormAction = $_SERVER['PHP_SELF'];

if (isset($_SERVER['QUERY_STRING'])) {
  $editFormAction .= "?" . htmlentities($_SERVER['QUERY_STRING']);
}

if ((isset($_POST["MM_insert"])) && ($_POST["MM_insert"] == "contact")) {
  $insertSQL = sprintf("INSERT INTO Alabama (Name, Email, Restaurant, Website, `Description`, URL) VALUES (%s, %s, %s, %s, %s, %s)",
                       GetSQLValueString($_POST['name'], "text"),
                       GetSQLValueString($_POST['email'], "text"),
                       GetSQLValueString($_POST['restaurant-title'], "text"),
                       GetSQLValueString($_POST['website'], "text"),
                       GetSQLValueString($_POST['description'], "text"),
                       GetSQLValueString($_POST['url-to-link-to'], "text"));

  mysql_select_db($database_myconn, $myconn);
  $Result1 = mysql_query($insertSQL, $myconn) or die(mysql_error());

  $insertGoTo = "thanks.php";
  if (isset($_SERVER['QUERY_STRING'])) {
    $insertGoTo .= (strpos($insertGoTo, '?')) ? "&" : "?";
    $insertGoTo .= $_SERVER['QUERY_STRING'];
  }
  header(sprintf("Location: %s", $insertGoTo));
}
?><!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><!-- InstanceBegin template="/Templates/restaurant-articles.dwt.php" codeOutsideHTMLIsLocked="false" -->
<head>
<meta http-equiv="content-type" content="text/html; charset=utf-8" />
<!-- InstanceBeginEditable name="doctitle" -->
<title>Advertise your restaurant for free</title>
<!-- InstanceEndEditable -->
<meta name="keywords" content="" />
<meta name="description" content="" />
<link href="style/usa.css" rel="stylesheet" type="text/css" />
<!-- InstanceBeginEditable name="head" --><!-- InstanceEndEditable -->
</head>
<body>
<!-- start header -->
<div id="header">
    <div id="logo">
        <h1><a href="#">foo-bar.com</a></h1>
        <p>&nbsp;</p>
  </div>
    <div id="menu">
        <ul>
            <li><a href="http://www.foo-bar.com/index.html">Home</a></li>
        <li><a href="http://www.foo-bar.com/restaurant-articles/index.php">Restaurant Articles</a></li>
            <li><a href="http://www.foo-bar.com/recipes/index.php">Recipes</a></li>
        </ul>
    </div>
</div>
<!-- end header -->
<div id="headerbg" align="center"><span style="white-space: nowrap" margin-top: "20px"><img src="images/restaurant.jpg"><img src="images/food.jpg"></span></div>
<!-- start page -->
<div id="page">
    <!-- start content -->
    <div id="content"><!-- start latest-post -->
      <!-- InstanceBeginEditable name="body" -->
      <div id="latest-post" class="post">
        <h1 class="title">Advertise your restaurant for free</h1>
        <div class="entry">
  <p>Fill in your details - and your information will be added to the relevant page for all to see.</p>
                <p><?php echo $error ?></p>
                <form name="contact" action="<?php echo $editFormAction; ?>" method="POST" id="contact">
                  <table width="95%" border="0" cellpadding="3" cellspacing="3" class="tableindent">
                    <tr>
                      <td><div align="right">Your Name:</div></td>
                      <td><input name="name" type="text" id="name" /></td>
                    </tr>
                    <tr>
                      <td><div align="right">Email:</div></td>
                      <td><input name="email" type="text" id="email" value="" /></td>
                    </tr>
                    <tr>
                      <td align="right" valign="top">Restaurant title:</td>
                      <td><input name="restaurant-title" type="text" id="restaurant-title" value="" />
                        (anchor text of link) </td>
                    </tr>
                    <tr>
                      <td align="right" valign="top">URL to link to: </td>
                      <td><input name="website" type="text" id="website" value="" />
                        <br />
                        (e.g. my-restaurant.com - do not include http or www.) </td>
                    </tr>
                    <tr>
                      <td align="right" valign="top">description:</td>
                      <td><textarea name="description" id="description" cols="45" rows="5"></textarea>
                        <br />
                        (up to 1000 words) </td>
                    </tr>
                    <tr>
                      <td><div align="right">URL you want to advertise on: </div></td>
                      <td><input name="url-to-link-to" type="text" id="url-to-link-to" value="<?php echo $_SERVER['HTTP_REFERER'];?>" size="40" readonly="true" /></td>
                    </tr>
                    <tr>
                      <td><div align="right"></div></td>
                      <td><input type="submit" name="submit" value="Submit Message" /></td>
                    </tr>
                  </table>
                  <p>The anchor text is the wording you wanted highlighted in blue as your link. </p>
                  <input type="hidden" name="MM_insert" value="contact" />
          </form>
          <p><!-- end latest-post -->
        <!-- start recent-posts -->
        </p>
        </div>
      </div>
      <!-- InstanceEndEditable -->
      <!-- end latest-post -->
        <!-- start recent-posts -->
  <div id="recent-posts">
            <div class="post">
                <h2 class="title">Restaurant Article</h2>
                <!-- InstanceBeginEditable name="restaurant-article" -->
                <div class="entry">
                  <p>How to open a successful restaurant..</p>
                  <p><a href="restaurant-articles/how-to-open-a-successful-restaurant.php" class="more">Read more</a></p>
                </div>
                <!-- InstanceEndEditable --></div>
            <div class="post">
                <h2 class="title">Recipe</h2>
                <!-- InstanceBeginEditable name="recipe" -->
                <div class="entry">
                  <p>A better pot roast..</p>
                  <p><a href="http://www.foo-bar.com/recipes/a-better-pot-roast.php" class="more">Read more</a></p>
                </div>
          <!-- InstanceEndEditable --></div>
          <div class="post">
                <h2 class="title">Restaurant Business Plan</h2>
                <!-- InstanceBeginEditable name="business-plan" -->
                <div class="entry">
                  <p>Italian Restaurant Business Plan </p>
                  <p><a href="http://www.businessplanning-4-you.com/business-plans/Italian-Restaurant-Business-Plan.html" target="_blank" class="more">Read more</a></p>
                </div>
                <!-- InstanceEndEditable --></div>
            </div>
        <!-- end recent-posts -->
    </div>
<!-- end content -->
    <!-- start sidebar -->
    <div id="sidebar">
        <ul>
            <li>

        </li>
        <li>

        </li>
  <li>


      </li>
        <li>

      </li>
    </ul>
  <div style="clear: both;">&nbsp;</div>
</div>
  <!-- end sidebar -->
</div>
<!-- end page -->
<div id="footer">
    <p id="legal">&copy;2008 All Restaurants USA. All Rights Reserved.</p>
  <p id="links"><a href="http://www.foo-bar.com/index.php">Home</a>&nbsp;&nbsp;&nbsp; |&nbsp;&nbsp;&nbsp; <a href="http://www.foo-bar.com/terms.php">Terms</a> &nbsp;&nbsp;&nbsp;|&nbsp;&nbsp;&nbsp; <a href="http://www.foo-bar.com/faq.php">FAQ</a> &nbsp;&nbsp;|&nbsp;&nbsp;&nbsp;<a href="http://www.foo-bar.com/contact.php">Contact Us</a></p>
</div>
</body>
<!-- InstanceEnd --></html>

[johnworf]

for example...

this works okay in if the hidden field has some data it takes you to the naugty-robot.php page

$editFormAction = $_SERVER['PHP_SELF'];
if (!empty($_POST['address'])) {$error .= "You filled in a field you shouldn't - naughty robot!<br>";}
if($error) { 
include("naughty-robot.php"); 
}

but if i add another few lines to see if the name field is empty the line:
You didn't give us your name. is echoed out before i've even submitted the form.
And if i submit the form with no name it comes up Column 'Name' cannot be null.
In my opinion it should take the person to index.php if it's empty.
So basically my if statements seem to be ignored.

$editFormAction = $_SERVER['PHP_SELF'];
if (!empty($_POST['address'])) {$error .= "You filled in a field you shouldn't - naughty robot!<br>";}
if($error) { 
include("naughty-robot.php"); 
}
if (empty($_POST['name'])) {$error .= "You didn't give us your name.<br>";}
if($error) { 
include("index.php"); 
}

[dalecosp]

In my opinion it should take the person to index.php if it's empty.

Well, what you've written says that index.php will be "included", but I'd interpret "take the person to index.php" to mean using an HTTP header to relocate the browser to index.php instead. That may be merely a point of semantics, but I can't tell from code snippets exactly what's going on.

For example, might you want to call:

include "index.php";
exit;

It really depends on how the system is designed. I've seen lots of pages where it appears the code is something like this:

if ($error) {
   header("location:index.php?error=no_name_given");
}

So then you're taken to the index page and provided with a (hopefully) meaningful error message.

I can see OTOH, how a site could be set up to use include statements. However, one possible error in doing so is that you don't stop processing after a particular include form, in which case your PHP enabled server will give you a conglomerate page that includes a few different scripts strung together.

I've got a busy day out of office today, so I'll wish you luck in sorting things out.

[johnworf]

okay dale - i'll give that a go - thanks again.

john

[johnworf]

okay i tried adding that:

and when i click the link it just takes me straight (redirects) to the index.php?error=no_name_given

if (empty($_POST['name'])) {$error .= "You didn't give us your name.<br>";}
if($error) { 
header("location:index.php?error=no_name_given"); 
}

[dalecosp]

Well, if you click on a link, then you didn't POST a form, so the check for POST['name'] will obviously fail.