Hi, I've heard that it is important to make a contact form secure to avoid spam attacks etc but have no clue how to do it really. Have found some quite old tutorials but think they may be out of date. It took me long enough to get the contact form working so I don't know where to start with making it secure. Are there any simple lines of code that I can add to make it more secure from attacks?

My code is below. Any help much appreciated.


Code:

<br/><h3>Email the site</h3><p>If you have any comments or questions about the site then please feel free to send me an email. </p><form method="POST" action="mailer.php"> Name: <br><input type="text" name="name" size="19"><br> <br> Email:<br> <input type="text" name="email" size="19"><br> <br> Your Comments: <br> <textarea rows="14" name="message" cols="50"></textarea> <br> <br> <input type="submit" value="Submit" name="submit"></form>

mailer.php:

<?php 
if(isset($_POST['submit'])) { 
$to = "myemail.com"; 
$subject = "Feedback"; 
$name_field = $_POST['name']; 
$email_field = $_POST['email']; 
$message = $_POST['message']; 
$body = "From: $name_field\n E-Mail: $email_field\n Message:\n $message"; 
echo "Data has been submitted to $to!"; mail($to, $subject, $body); 
} 
else { echo "blarg!"; } ?>

You may want to use strip_tags on $message. You can also use a session variable to ensure that a user cannot submit multiple times within a certain period of time:

PHP Code:

$interval = 60; //60 seconds;
$send = true;

if((time() - $_SESSION['last_submit']) < $interval)
{
     $send = false;
}
else if(!$_SESSION['last_submit'])
{
     $_SESSION['last_submit'] = time();
}

if($send)
{
     if(isset($_POST['submit'])) { 
          $to = "myemail.com"; 
          $subject = "Feedback"; 
          $name_field = $_POST['name']; 
          $email_field = $_POST['email']; 
          $message = strip_tags($_POST['message']); 
          $body = "From: $name_field\n E-Mail: $email_field\n Message:\n $message"; 
          echo "Data has been submitted to $to!"; mail($to, $subject, $body); 
     } 
     else
          echo "blarg!"; 
} 


Also you may want to verify that the email address field is not blank and properly formatted.

Many Thanks for that.

Can you tell me, does this protect from sql injection attacks at all?

Cheers.

Originally Posted by gh05

Many Thanks for that.

Can you tell me, does this protect from sql injection attacks at all?

Cheers.

If you are not creating an SQL query with data submitted by GPC (get, post, cookie), then there is no worry of SQL injection.