hi ,
I followed a procedure from a website to create a form ..but the validation is not working ..it ignores to check the required feild and just sends the confirmation mail ..what could be the reason ?....pls help..my code :

<?

session_start();
function checkOK($field)
{
if (eregi("\r",$field) || eregi("\n",$field)){
die("Invalid Input!");
}
}

$name=$_POST['name'];
checkOK($name);
$email=$_POST['email'];
checkOK($email);
$telephone=$_POST['telephone'];
checkOK($telephone);
$address=$_POST['address'];
checkOK($address);
$comments=$_POST['comments'];
checkOK($comments);
$to="userid@domain.name";
$message="$name just filled in your comments form. They said:\n$comments\n\nTheir e-mail address was: $email and telephone:$telephone with Address as:$address";
if(mail($to,"Comments From Your Site",$message,"From: $email\n")) {
echo "Thanks. your request has been received.";
} else {
echo "There was a problem sending the mail. Please check that you filled in the form correctly.";
}
?>


thanks

Putting an IF function around the checkOK() parts would be a good idea. The do an analysis of what's exactly wrong.

** reads code **

It could also be that, all your checking for is line breaks. Which tends to appear a lot anyway, and also does no harm.

PHP Code:

<?

session_start();
function checkOK($field)
{
if (eregi("\r",$field) == TRUE || eregi("\n",$field) == TRUE){
die("Invalid Input!");
}
}

$name=$_POST['name'];
checkOK($name);
$email=$_POST['email'];
checkOK($email);
$telephone=$_POST['telephone'];
checkOK($telephone);
$address=$_POST['address'];
checkOK($address);
$comments=$_POST['comments'];
checkOK($comments);
$to="userid@domain.name";
$message="$name just filled in your comments form. They said:\n$comments\n\nTheir e-mail address was: $email and telephone:$telephone with Address as:$address";
if(mail($to,"Comments From Your Site",$message,"From: $email\n")) {
echo "Thanks. your request has been received.";
} else {
echo "There was a problem sending the mail. Please check that you filled in the form correctly.";
}

I would put an echo() or something in the checkOK function: it might actually be getting called, unless you know otherwise of course. If it is, your eregi just doesn't work.

Sorry i dont quite get why you are doing the eregi on \r and \n whats the purpose?

Why don't you use this approach?

PHP Code:

if ($name == ""){
?><font color="#ffffff">You must enter your name</font><?php
}

This works for me. If the name is not entered, the script stops, and no email is sent. Apart from that, the script will halt and will not go any further until the user corrects the issue.

EEEWW <font> tag Ew bad paul..

lol, I don't even use that way anymore!! I was tired last night and I was already rewriting a script that had that in. My bad!!

PHP Code:

if ($name == ""){
echo "You must enter your name";
} 


I used to do it that way when I didn't understand how to put font colours and sizes and stuff like that into PHP. Now I do.

PHP Code:

if ($name == ""){
echo "<font color=\"#ffffff\">You must enter your name</font>" ."";
} 


Doublw EEw YOUR STIlL USING <font> TAG!! XD EEEW

OMG the font tag AHHHHH! Use CSS

Run AWAY!.....

- not that i am obsessed with Monty Python or anything.. You know having a quote for all occasions..

Umm , lovely

Back on topic - If your going to do server side validation then you might as well cover all bases. Email injection is painful http://www.tonyspencer.com/2005/12/1...-contact-form/

That is SO FREAKKY!

i was making a script today and was ticking off all the security i had (and needed to add) and was thinking should i add any security to the email ?

i never seen anything about it interesting...

Would the mysql_real_escape_string() work to stop this as well as SQL injection?

There are other ways of protecting from mail injection, ie. CAPTCHAs and a new technique using a form element way off the side of the screen tha tonly a bot would fill in.

?


or... just use CSS to make it the same as your background... (which i did when i made a proxy for my school it was a clone of the school website andthe field was hidden in the page