Help needed on php forms

malik112

Hi,

My website has a long forms with many fields.
Some of these fields have dropdown lists to be selected by the user and some have text boxes.

Recently, I have noticed some attacks wherein when I receive the form email all fields are filled in by random numbers!

I understand that this can happen for the text boxes but how can someone fill in numbers on a field that has a dropdown list?

The form has basic validation to check mandatory fields, phone no and emails address. The page is in Simplified Chinese

Can anyone please help? This problem has been bugging me just too much now.

Thanks
Malik

DexterMorgan

It could be bots doing it, I have had these problems before lol.

There are various ways to stop this like recaptcha.

You could add a hidden field to the form that a user wont see but a bot would fill in, then u check if this field has been filled in when you validate everything if so, abort the process.

malik112

thanks for your reply. thats obvious these are bots. i dont think a user can enter values in a dropdown field.

i dont want to add recaptcha because there are already so many mandatory fields a user has to fill. i dont want to push extra onto him.

can you suggest a way where i can add security at the server end so this doesnt happen.

your reply is much appreciated.

thanks.

NogDog

I find the following two steps stop a lot of bots:

form:

<?php
session_start();
$_SESSION['token'] = uniqid();
?>
<html><head><title>example</title>
<style type='text/css'>
#xxx { display: none; }
</style>
</head>
<body>
<form action='foo.php' method='post'>
<input type='hidden' name='token' value='<?php echo $_SESSION['token']; ?>' />
<input type='text' name='xxx' id='xxx' value='' />
<!-- rest of form -->
</form>

Then in your form-handler, do a session_start(), and verify that (a) $POST['token'] == $SESSION['token'] and (b) $_POST['xxx'] is empty. (Change 'xxx' to some name that seems obvious: "name", "date", etc. -- and don't forget to change it in the CSS.)

malik112

Hi.. thanks for your reply.
Unfortunately, I am very new in php and dont really know how can I implement the code you have given.. for instance what is meant by "do a session_start()" etc.

Could you please explain how I can implement in a step by step process.
I know I am asking too much but I will be really grateful if you could explain in a layman's terms who is very new to php.

Thank you.

NogDog

<?php
session_start();
if(
   empty($_POST['token']) or                 // this must be set
   empty($_SESSION['token']) or              // so must this
   $_POST['token'] != $_SESSION['token'] or  // and they must be equal
   !empty($_POST['xxx'])                     // dummy field must be empty
) {
   die("Sorry, your request could not be processed, please try again.");
}
// rest of form-handling code follows
//

(Remember that "xxx" here is a place-holder pending you choosing some form element name/id that sounds logical and obvious for your form, though you are not going to acutally use it for anything.

malik112

Hi Nogdog,

Sorry to be asking so many questions. I am sure this code with work but I am still not sure where to put it?

Wts the relation between code 1 and code 2 that you gave me.
In your prev reply, you mentioned to change some part of CSS also.

This is what I have -
1. A php form page.
2. A php thank you page which triggers after the form is filled and validated by the Javascript validation.

Now, I understand that the code in your first message should be used above the form but where do I use the second code? In the form page or in the thank you page.

I want to understand what is happening with this code, so I dont ask you too many stupid questions.

Thank you very much.

I am planning to replace xxx by $email. Can you tell me what should I do first and next.

Appreciate your help.

Safit_P

I have read at php form tutorial that you can use an input field and a PHP code to check the entered code. Here is an example code for the HTML form:

Access code: <input /><br />
Please enter <b>MYCODE</b> above.

Then you can simply the check if the entered code matches, with a PHP help. Please, compare the code in lower-case to avoid issues with a typing in CaSe SeNSiTiVe code:

If (strtolower($_POST[‘code’]) != 'mycode') {die('Wrong access code');}

The form will be submitted only after the time, when the person enters the correct access code.