This is my contribution to the PHP world for contact us message processing that blocks spammers and hackers, validates forms, emails valid results only. In other words, what it's supposed to do.
I'm on a one-page PHP kick right now, so I'm going to do both the HTML form and the PHP code to process it on the same page. Just save this file as example.php somewhere. My comments are throughout.
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<title>Josh's Nearly Perfect Form Example</title>
<style>
body{
background: #fff;
font-size:16px;
}
a{
text-decoration:none;
}
<?php
// This will only process the form if the form has been posted to it.
if($_SERVER['REQUEST_METHOD']=='POST') {
if($_POST['name']){
/* they posted the name, but we still need to validate it to see if they're dirty rotten spammers */
if(substr_count($_POST['name'],'<') > 1 || substr_count($_POST['name'],'>') > 1){
$error[] = "You dirty rotten spammer, you. Stop submitting links or I'll hunt you down.";
}else{
$name = $_POST['name'];
/* create a session for the variable in case there are errors, we don't want them to have to enter the whole form again! */
$_SESSION['name'] = $name;
}
}else{
/* create an array of error messages */
$error[] = "You need to enter your name.";
}
if($_POST['email']){
/* there was something entered, but was it an email? */
$email = $_POST['email'];
/* $e = email pattern */
$e = "/^[-+\\.0-9=a-z_]+@([-0-9a-z]+\\.)+([0-9a-z]){2,4}$/i";
//
if(!preg_match($e, $email)){
/* then the email doesn't match the pattern */
$error[] = "Your email address isn't valid";
}else{
$_SESSION['email'] = $email;
}
}else{
$error[] = "You need to enter your email address.";
}
if($_POST['message']){
/* We've got something, so let's check for spammers */
if(substr_count($_POST['message'],'<') > 1 || substr_count($_POST['message'],'>') > 1){
$error[] = "You bad, bad spammer, you. Stop submitting links or I'll hunt you down.";
}else{
$message = $_POST['message'];
$_SESSION['message'] = $message;
}
}else{
$error[] = "You need to enter a message.";
}
/* ok, if we have an error, then we need to show them to the user, but also keep the valid data in the form and just delete the data that didn't pass validation */
if($error){
foreach($error as $e){
echo "<b>" . $e . "</b><br>";
}
}else{
/* We passed validation so kill the session (you may not want to do this if you're using sessions on your site. You can just unset the session variables we set above. */
$_SESSION = array();
/* wrap the message every 70 characters for readability */
$message = wordwrap($message, 70);
/* This is a little silly, but you never know about spammers, so let's remove the gt & lt signs from the message just in case */
$message = str_replace("<","",$message);
$message = str_replace(">","",$message);
/* and while we're at it, let's remove their URL openings too */
$message = str_replace("http://","",$message);
$message = str_replace("www.","",$message);
/* Now that the message is scrubbed, add the IP address to the end of it so that we can block anyone that overmails us */
$message = $message . "\n" . $_SERVER['REMOTE_ADDR'];
/* Pretty standard stuff from here on out */
$headers = 'MIME-Version: 1.0' . "\r\n";
$headers .= 'Content-type: text/html; charset=iso-8859-1' . "\r\n";
/* Additional headers, change out the two joshua@joshua.com references for your email! */
$headers .= "To: Joshua <joshua@joshua.com>" . "\r\n";
$headers .= "From: $email" . "\r\n" . "Reply-To: $email" . "\r\n";
Luiz Araujo wrote :1831
Thanks for this nice script.
It works fine if I use <textarea> instead of <text area>.
Donald Grouns wrote :1832
Just a short note to say that when I first tried the
script both in my Kompozer WYSIWYG and EditPlus3 and then
also on my server the message box in the form did not
show. I looked again at the code and see that there is an
error in Line 133 (at least on my code page) instead of
Terry Wysocki wrote :1833
Also, you have to name the file "contact.php" on your
server. Otherwise adjust the line that says
action="contact.php" to whatever you name the file.
Donald Grouns wrote :1834
One additional note... for dummies like me, for this
script to work it needs to be named contact.php or the
line in the code showing the "form action" needs to be
changed to whatever the page name you choose, of course
with a .php extension.
Nathan Sepulveda wrote :1835
When offering code to the public that posts back to itself, I would recommend using $_SERVER['PHP_SELF'] instead of a page name that. that way there are no naming issues involved.
Greg Schiedler wrote :1836
Code needs some work or possibly a line to download the
code. I have tried it on several machines and two
different connections. All fail to show a message box
that you can type anything into.
Joshua Walcher wrote :1837
I know that nobody is reading these comments, but yes, it should be:
input type="textarea"
instead of:
input type="text area".
WeberDev doesn't offer any method of editing after submission.
Additionally, the opening form tag should say either the name of the file you are on or:
<?php echo $_SERVER['PHP_SELF']; ?>
as the action.
Boaz Yahav wrote :1838
Actually someone from weberdev makes an effort to read all
comments and make needed changes. You can always contact
us to pdate code.
Joshua Walcher wrote :1839
Sorry, wasn't meaning to insult WeberDev. Thanks for the
updates to the script and I'll make sure my shiznit is in
order next time I submit.
Boaz Yahav wrote :1840
The most important thing is to keep submitting code examples :)
