View Thread: PHP contact form - Killersites.com Forum

Welcome Guest | Register | Login

Killersites.com Forum

Category: Programming

Forum: PHP Programming

Thread: PHP contact form

Quick Go »

No member browsing this thread

Thread Status: Active
Total posts in this thread: 14

[ ]

Author

This topic has been viewed 46103 times and has 13 replies

sparrow
Advanced Member

Joined: Sep 21, 2005
Post Count: 221
Status: Offline


PHP contact form

I am getting frustrating for the last 3 days as to why there is an undefined error like this

Undefined variable: err in \\nas39ent\domains\p\pcglow.co.uk\user\htdocs\contact.php on line 69

which displays before the contact form, see this

http://www.pcglow.co.uk/contact.php

I have checked all variables in PHP code which seems all correct..

<?php
ini_set("sendmail_from", " support@pcglow.co.uk ");
if(isset($_POST['Submit'])) {
$name = $_POST['name'];
$email = $_POST['email'];
$telephone = $_POST['telephone'];
$enquiry = $_POST['enquiry'];
if($name == '' or $email == '' or $telephone == '' or $enquiry == '') {$err = true;
$msg = 'Please complete your name, email address, telephone and enquiry to submit the form.';} else {
$mailmsg = 'The following email has been sent from the contact form:' . "\n\n";
$mailmsg.= 'Name: ' . $name . "\n";
$mailmsg.= 'Email: ' . $email . "\n";
$mailmsg.= 'Telephone: ' . $telephone . "\n";
$mailmsg.= 'Enquiry: ' . $enquiry . "\n";
if($mailing == 'true') {
$mailmsg.= 'I would like to be added to the mailing list';}
if (eregi("\r",$email) || eregi("\n",$email)){die ("spam!");
} else {if(mail('support@pcglow.co.uk','Contact Form', $mailmsg, "From: support@pcglow.co.uk")) {header("Location: thank-you.html");
}
}
}
}
?>

and in HTML before the form id..

<?php
if($err == true) {
echo '<p class="error">'. $msg . '</p>';
}
?>

Any help is much appreciated.
Many thanks

[Sep 14, 2008 2:27:59 PM]

[Link]

falkencreative
Advanced Member

USA
Joined: Aug 14, 2007
Post Count: 1129
Status: Offline


Re: PHP contact form

Here's one slightly different way to implement this...

In your if statement below:

if($name == '' or $email == '' or $telephone == '' or $enquiry == '') {
$err = true;
$msg = 'Please complete your name, email address, telephone and enquiry to submit the form.';}

try this:

if($name == '' or $email == '' or $telephone == '' or $enquiry == '') {
header("Location: contact.php?err");

This will set the $err variable to true.
Then, in your error block:

<?php
if($err == true) {
echo '<p class="error">'. $msg . '</p>';
}
?>

try this:

<?php
if (isset($_GET['err']) == true) {
echo '<p class="error">Please complete your name, email address, telephone and inquiry to submit the form.</p>';
}
?>

This will check the URL for the $err variable, and display the error if the URL includes it.
----------------------------------------
Benjamin Falk | student : designer : developer
Twitter: falkencreative

[Sep 14, 2008 7:01:01 PM]

[Link]

sparrow
Advanced Member

Joined: Sep 21, 2005
Post Count: 221
Status: Offline


Re: PHP contact form

Thanks falconcreative, you are a cracker, it works. As you said make sure that it is a basic Javascript validation but is this code I use have a basic validation ?

As tpattison mentions on previous post saying I may need to put in a fake email address to stop the bots crawling it, how can I receive mail if I put fake email address ?

Thanks

[Sep 15, 2008 3:02:02 AM]

[Link]

sparrow
Advanced Member

Joined: Sep 21, 2005
Post Count: 221
Status: Offline


Re: PHP contact form

Contact form is working but request form is not working!!

See contact form
http://www.pcglow.co.uk/contact.php

when you enter all the details, it works fine but when you enter all the details on request form, it fails. see this

http://www.pcglow.co.uk/request-form.php

I think there is coding problem somewhere espcially if else statement....

if($name == '' or $email == '' or $telephone == '' or $make == '' or $model == '' or $symtoms == '') {
header("Location: request-form.php?err");
} else {......

Any idea ?

[Sep 16, 2008 5:34:51 PM]

[Link]

falkencreative
Advanced Member

USA
Joined: Aug 14, 2007
Post Count: 1129
Status: Offline


Re: PHP contact form

I'm not seeing anything specific in that snippet... perhaps post the full processing code?
----------------------------------------
Benjamin Falk | student : designer : developer
Twitter: falkencreative

[Sep 16, 2008 5:50:46 PM]

[Link]

billyboy
Advanced Member

Joined: Sep 3, 2005
Post Count: 2206
Status: Offline


Re: PHP contact form

As was pointed out in the other thread you started on this. That code is VERY UNSECURE. Merely checking to see that fields are not empty or that the email field doesn't contain new line or carriage return characters is not even close to being enough validation. You're leaving yourself wide open to all sorts of exploits. Take some time to read up on form security. exploits, attacks, that sort of thing. In the meantime protect yourself by taking that offline and using a third party script with decent security.

Using the $GET variable and redirecting to a new page to check if a value is true seems like a ridiculously long way around to perform a simple step.
----------------------------------------
Quiquid latine dictum sit altum viditur

[Sep 17, 2008 3:10:48 AM]

[Link]

falkencreative
Advanced Member

USA
Joined: Aug 14, 2007
Post Count: 1129
Status: Offline


Re: PHP contact form

Using the $GET variable and redirecting to a new page to check if a value is true seems like a ridiculously long way around to perform a simple step.

Just for my personal knowledge, as I am not an expert in PHP in any way, what would be a better way to approach this then?
----------------------------------------
Benjamin Falk | student : designer : developer
Twitter: falkencreative

[Sep 17, 2008 11:46:24 AM]

[Link]

sparrow
Advanced Member

Joined: Sep 21, 2005
Post Count: 221
Status: Offline


Re: PHP contact form

Hello here is the snippet on request form which doesnt work when enter all the fields and came up an error, see this

http://www.pcglow.co.uk/request-form.php

<?php
ini_set("sendmail_from", " support@pcglow.co.uk ");
if(isset($_POST['Submit'])) {
$name = $_POST['name'];
$email = $_POST['email'];
$telephone = $_POST['telephone'];
$make = $_POST['make'];
$model = $_POST['model'];
$symtoms = $_POST['symtoms'];
if($name == '' or $email == '' or $telephone == '' or $make == '' or $model == '' or $symtoms == '') {
header("Location: request-form.php?err");
} else {
$mailmsg = 'The following email has been sent from the contact form:' . "\n\n";
$mailmsg.= 'Name: ' . $name . "\n";
$mailmsg.= 'Email: ' . $email . "\n";
$mailmsg.= 'Telephone: ' . $telephone . "\n";
$mailmsg.= 'Make: ' . $make . "\n";
$mailmsg.= 'Model: ' . $model . "\n";
$mailmsg.= 'Symtoms: ' . $symtoms . "\n";
if($mailing == 'true') {
$mailmsg.= 'I would like to be added to the mailing list';}
if (eregi("\r",$email) || eregi("\n",$email)){die ("spam!");
} else {
if(mail('support@pcglow.co.uk','Request Form', $mailmsg, "From: support@pcglow.co.uk")) {header("Location: thank-you.html");
}
}
}
}
?>

and before the form id..

<?php if (isset($_GET['err']) == true) {echo '<p class="error">Please complete your name, email, telephone and enquiry to submit the form.</p>';}
?>

If I remove $make == '' or $model == '' in if statement, it works ok, look like if statement is too long ?

Contact form works fine, see this
http://www.pcglow.co.uk/contact.php

Billyboy, I have seen some websites using this similar method, can you show an example what the PHP code should be in order to make it secure ?

[Sep 17, 2008 12:55:25 PM]

[Link]

falkencreative
Advanced Member

USA
Joined: Aug 14, 2007
Post Count: 1129
Status: Offline


Re: PHP contact form

OK, I found your problem... your HTML form is using a textarea called "enquiry", while your PHP code refers to it as "symptoms". Fix that, and it should start working properly.

As far as the security issue, yes, this is definitely something you should be looking at. At the moment, all you are doing is checking if the inputs hold any value... I'd suggest doing some web searches for "sanitizing inputs php" just so you have a general idea of the issues involved.

As far as this:

Using the $GET variable and redirecting to a new page to check if a value is true seems like a ridiculously long way around to perform a simple step.

There are different ways to do form validation, and the way I suggested is in no way the "best" or "right" way. Hopefully BillyBoy will offer some alternative ways of approaching this. I'm still getting into PHP myself, and while the method I suggested works, like BillyBoy said, it may be needlessly complicated.
----------------------------------------
Benjamin Falk | student : designer : developer
Twitter: falkencreative

[Sep 17, 2008 2:26:32 PM]

[Link]

billyboy
Advanced Member

Joined: Sep 3, 2005
Post Count: 2206
Status: Offline


Re: PHP contact form

If that is the only validation other sites are using then they're just as open to attacks as you are. Here's three form scripts that have decent security features, you'll see they all do far, far more than just check for empty fields or /n and /r in the email field.
http://www.tectite.com/
http://green-beast.com/gbcf-v3/
http://www.dbmasters.net/index.php?id=4

Ben, I am no expert myself but all that is needed is something like:

if (condition) {
   $err = 'blah blah blah';
 }
else if (another condition) {
   $err = 'blah blah blah';
 }
else {
 do something if no conditions are matched
}

Then check to see if $err is an empty string

if ($err !='') {
 do something on error
}

----------------------------------------
Quiquid latine dictum sit altum viditur

[Sep 17, 2008 3:15:17 PM]

[Link]

[ ]

Current timezone is GMT
May 21, 2013 7:19:28 PM