0
<head>lols</head> and <script>!@#$%^&</script> in the name and comments fields and when pressed submit it still sent me the email. Although as described in the tutorial its supposed to stop spaces/special/specialcharacters/and any html values submitted by the user. The author has tried to achieve this by adding these snippets of code in the script
if (!isset($_POST['submit'])) {
echo "<h1>Error</h1>\n
<p>Accessing this page directly is not allowed.</p>";
exit;
}
This works fine as it does stop the user from accessing the form directly.
function cleanUp($data) {
$data = trim(strip_tags(htmlspecialchars($data)));
return $data;
}
Doesn't work as mentioned previouslyfunction cleanUp($data) {
$data = trim(strip_tags(htmlspecialchars($data)));
return $data;
}
$name = cleanUp($_POST['name']);
$email = cleanUp($_POST['email']);
$url = cleanUp($_POST['url']);
$comments = cleanUp($_POST['comments']);
Doesn't work as well as mentioned previouslyAnd finally
$email = preg_replace("([\r\n])", "", $email);
$find = "[content-type|Content-Type|bcc:|cc:]";
if (preg_match($find, $name) || preg_match($find, $email) || preg_match($find, $url) || preg_match($find, $comments)) {
<p>No meta/header injections, please.</p>";
exit;
}
This also doesnt work as i am still able to manupilate my headers through the fields.Full code for form.php
<form action="process.php" method="post"><p> <input type="text" name="name" id="name" value="Name" /><br /> <input type="text" name="email" id="email" value="Email" /><br /> <input type="text" name="url" id="url" value="URL" /><br /> <textarea name="comments" id="comments"> Comments </textarea><br /> <input type="submit" name="submit" id="submit" value="Send" /> </p></form>
Full code for process.php
<?php
if (!isset($_POST['submit'])) {
echo "<h1>Error</h1>\n
<p>Accessing this page directly is not allowed.</p>";
exit;
}
function cleanUp($data) {
$data = trim(strip_tags(htmlspecialchars($data)));
return $data;
}
$name = cleanUp($_POST['name']);
$email = cleanUp($_POST['email']);
$url = cleanUp($_POST['url']);
$comments = cleanUp($_POST['comments']);
if ((empty($name)) || (empty($email)) || (empty($comments))) {
echo "<h2>Input Error</h2>\n
<p><strong>Name</strong>, <strong>e-mail</strong> and <strong>comments</strong> are required fields. Please fill them in and try again:</p>";
echo "<form action=\"process.php\" method=\"post\"><p>";
echo "<input type=\"text\" name=\"name\" id=\"name\" value=\"$name\" /> Name<br />";
echo "<input type=\"text\" name=\"email\" id=\"email\" value=\"$email\" /> E-mail<br />";
echo "<input type=\"text\" name=\"url\" id=\"url\" value=\"$url\" /> Site URL<br />";
echo "<textarea name=\"comments\" id=\"comments\">$comments</textarea> Comments<br />";
echo "<input type=\"submit\" name=\"submit\" id=\"submit\" value=\"Send\" />";
echo "</p></form>";
exit;
}
if (!ereg("^[_a-zA-Z0-9-]+(\.[_a-zA-Z0-9-]+)*@[a-zA-Z0-9-]+(\.[a-zA-Z0-9-]+)*$",$email)) {
echo "<h2>Input Error</h2>\n
<p>The e-mail address \"$email\" isn't valid. Please edit it and try again:</p>";
echo "<form action=\"process.php\" method=\"post\"><p>";
echo "<input type=\"text\" name=\"name\" id=\"name\" value=\"$name\" /> Name<br />";
echo "<input type=\"text\" name=\"email\" id=\"email\" value=\"$email\" /> E-mail<br />";
echo "<input type=\"text\" name=\"url\" id=\"url\" value=\"$url\" /> Site URL<br />";
echo "<textarea name=\"comments\" id=\"comments\">$comments</textarea> Comments<br />";
echo "<input type=\"submit\" name=\"submit\" id=\"submit\" value=\"Send\" />";
echo "</p></form>";
exit;
}
$email = preg_replace("([\r\n])", "", $email);
$find = "[content-type|Content-Type|bcc:|cc:]";
if (preg_match($find, $name) || preg_match($find, $email) || preg_match($find, $url) || preg_match($find, $comments)) {
echo "<h1>Error</h1>\n
<p>No meta/header injections, please.</p>";
exit;
}
$recipient = "youremail@url.com";
$subject = "personal website submission form";
$message = "Name: $name \n";
$message .= "E-mail: $email \n";
$message .= "URL: $url \n";
$message .= "Comments: $comments";
$headers = "From: My Form \r\n";
$headers .= "Reply-To: $email";
if (mail($recipient,$subject,$message,$headers)) {
echo "<p>Mail sent successfully.</p>";
} else {
echo "<p>Mail not sent this time.</p>";
}
?>
Now my question is as to what is wrong with this code that its not doing what it's supposed to do ? Any corrections or suggestions will be appreciated.
Also can you people explain methods your using yourself to prevent header/mysql injections and making your contact/feedback forms more secure ??? Any good tutorials out there which give a step to step guide for creating a secure php contact form ??? I have tried tons of search engines and tutorial engines but the tutorials they have are either outdated or arn't what i am looking for. Thx in advance
Edited by unstopabl3, 16 March 2006 - 02:55 PM.
