[ Date Index ] [ Thread Index ] [ <= Previous by date / thread ] [ Next by date / thread => ]
Hello Simon, all
Thanks for your message.
After many hours of studying, I have written this PHP code.
Significantly of my own doing on the basis of web-searching.
As you will see;
I've written in code which checks what's submitted from the "forms".
Also put size limits to prevent "denial of service" attacks filling up
my webhosting quota.
vvvvvvvv mail_handler.php vvvvvvvv
<?php
if(isset($_POST['submit'])){
$to = "ME@xxxxxxxxxxx"; // this is your Email address
// handle supplied email...
$sf_from = filter_var(trim($_POST['email']), FILTER_SANITIZE_EMAIL);
if(strlen($sf_from) > 64){
echo "Use a briefer email addr";
exit(0);
}
if (!filter_var($sf_from, FILTER_VALIDATE_EMAIL)) {
echo("$sf_from is not a valid email address. You might be able to
Browser-back, correct and re-submit");
exit(0);
}
// handle supplied name...
$sf_name = filter_var(trim($_POST['submitter_name']), FILTER_SANITIZE_STRING);
if(strlen($sf_name) > 64){
echo "Use a briefer name";
exit(0);
}
// handle the submitted message...
$sf_message = filter_var(trim($_POST['message']), FILTER_SANITIZE_STRING);
if(strlen($sf_message) > 2000){
exit("Submit a briefer message");
}
// DEBUG // echo $to . " " . $sf_from . " " . $sf_name . " " . $sf_message;
// this is assembling what's passed to mail()...
$subject = "Form submission";
$message = $sf_name . " at " . $sf_from . "\n\n" . " wrote the following:" .
"\n\n" . $sf_message;
$headers = "From:" . $sf_from;
mail($to,$subject,$message,$headers);
// echo "Mail Sent. Thank you " . $sf_name . ", I will contact you shortly.";
header('Location: thanks_fsub.html');
// You cannot use header and echo together. It's one or the other.
}
?>
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
I have done the best I can (not any professional's grade) to crash it.
So far so good.
As nothing is going into a database (SQL, "injection" and all that),
this is not a particularly "hazardous" application of "forms" and PHP?
Insignificant/no changes elsewhere.
To be seen at
http://weldsmith.co.uk/contactform/contact.html
How am I doing now?
Regards,
Rich Smith
> On 5 Jul 2023, at 21:28, Simon Avery <digdilem@xxxxxxxxx> wrote:
>
> Hi Rich,
>
> PHP web to email forms have a long and murky history - not helped by one of the
> most popular early ones being very easy to manipulate - and it was! I've no doubt
> it's still out there in many places and acting as an open relay for thousands of
> badly intentioned people. I certainly see bots searching for it on my web servers.
>
> The technical side of writing a web form is really very easy, php has email
> built-in after all, or you can use a local or remote smtp server to send it.
>
> Follow a few basic rules, and ensure you read up on php and web security first
> (there's lots of good guides out there so I won't repeat them badly here)
>
> DO: Sanitise input.
> DO: Hardcode the "To" address, always, to stop it being used as an open gateway.
>
> It will be abused, of course, and almost instantly. Bots are crawling html
> constantly for any form elements and will try to send spam through them. Why not,
> it costs them nothing?
>
> But generally - as with all things security - you can never be totally secure. If
> you have doubts, don't do it, or use one of the many freely available webforms,
> even if they're commercially operated.
>
> (The first example on your link is horrible - even if just because it doesn't
> hardcode the from. The first replier has fixed that.)
>
> On Sun, 2 Jul 2023 at 00:27, rds_met <dcglug@xxxxxxxxxxxxxxx> wrote:
> Hello all
>
> I found suggested code here:
> https://stackoverflow.com/questions/18379238/send-email-with-php-from-html-form-on-submit-with-the-same-script
>
> I copied the coupled html-forms code and PHP code into the two
> respective files.
> With due edits for my individual details.
>
> It seems to work perfectly.
>
> Anyone comment how
> * secure
> * etc.
> this is?
>
> Best wishes,
> Rich Smith
>
> --
> The Mailing List for the Devon & Cornwall LUG
> FAQ: https://www.dcglug.org.uk/faq/
> --
> The Mailing List for the Devon & Cornwall LUG
> FAQ: https://www.dcglug.org.uk/faq/
--
The Mailing List for the Devon & Cornwall LUG
FAQ: https://www.dcglug.org.uk/faq/