Form Validation Help

[mojito101]

Hi guys, I have recently started using some PHP. I have got my form working but I am worried about spammers exploiting my form. There are 2 things that I would like some help with.

1: How can I "spam proof" my form.
2: How can I limit the input in the number field to be only numbers and no letters or other characters.

Here is my code:

<?php
$recipient = '[e-mail]';
$subject = stripslashes($_REQUEST['busname']);
$from = stripslashes($_REQUEST['name']);
$number = stripslashes($_REQUEST['number']);
$town = stripslashes($_REQUEST['city']);
$state = stripslashes($_REQUEST['state']);
$hearabout = stripslashes($_REQUEST['hearabout']);
$email = stripslashes($_REQUEST ['emailadd']);
$messageinfo = stripslashes($_REQUEST['messageinfo']);
$subscribe = stripslashes ($_REQUEST['subscribe']);
$msg = "From: $from\nPhone: $number\nEmail: $email\nLocation: $town, $state\nHow did you hear about us? $hearabout\nSubscribe: $subscribe\n\n $messageinfo";

if (empty($subject) || empty($from) || empty($number) || empty($town) || empty($state) || empty($hearabout) || empty($email) || empty($messageinfo) || empty($subscribe)) {
    header( "Location: http://www.xxxx.com/error.html" );
  }



else { mail($recipient, $subject, $msg);
header( "Location: http://www.xxxx.com/thankyou.html" );
}

?>

Any help would be greatly appreciated.

[zypher11]

You would use is_int to check if it's a number (that would ONLY return true if its an *******. If your accepting decimal points you would use is_float. As far as spam proofing it, you could either create a low level captcha (generate random string and require they insert it into a box) or you could go for a captcha generated in an image. Go http://us2.php.net/manual/en/book.image.php to read up on that.

[zypher11]

lol.. apparently the forum thinks the word "int iger" is a swear :p

[mojito101]

zypher11;10954912 wrote:

You would use is_int to check if it's a number (that would ONLY return true if its an *******. If your accepting decimal points you would use is_float. As far as spam proofing it, you could either create a low level captcha (generate random string and require they insert it into a box) or you could go for a captcha generated in an image. Go http://us2.php.net/manual/en/book.image.php to read up on that.

Ahh awesome, thank you very much that's perfect!

[bradgrafelman]

zypher11;10954913 wrote:

lol.. apparently the forum thinks the word "int iger" is a swear :p

It probably thought you were trying to obfuscate a racial slur.

At any rate, we should probably just stick with the word "integer" instead. 😉

EDIT: Also note that there should be no reason why you would need to use [man]stripslashes/man on incoming data. Instead, you should ensure that magic_quotes_gpc is disabled.