PHP Question

[rkahn144]

Hey folks -

I have a contact form setup at www.mydomain.com/contact.html .

After someone enters there info, /mail.php processes it and they are then returned to my homepage.

An issue I am having is that people (or bots) are going to /mail.php directly which causes me to have a blank contact form sent to me.

Is there a way to restrict individuals from going directly to /mail.php or to prevent the blank contact forms from being sent to me?

Any suggestions will be appreciated. Thanks!

 

[monaco]

You could use mod_rewrite to check the referrer and handle it at the httpd level

OR

You could use PHP's $_SERVER['HTTP_REFERER'] property to just not submit the form.

 

[Dan]

You could check if there is anything in the message variable. Post the code of mail.php and someone can edit it for you.

 

[monaco]

You could check if there is anything in the message variable. Post the code of mail.php and someone can edit it for you.

He mentioned bots might be doing it. I proposed my solution because it could help him avoid getting spammed when the spam crawler bots decide to shove it full of advertisements.

But yea, post the code, all of the techniques mentioned are simple < 2 minute edits.

 

[Wildhoney]

Alternatively you could use an image verification such as Captcha. This will typically prevent bots from bypassing the form without entering the correct code. It need not be anything complex as the only sites that have to worry about their complexity would be such sites like Gmail, who would be a prime target for people trying to decipher their verification image.

 

[Barrucadu]

You could just use this:

//Put this immediatly after the <?php tag
if(!isset($_POST['variable_name']) || empty($_POST['variable_name'])){
     header('Location: http://www.domain.com/page.php');
}

 

[rkahn144]

Mikor or anybody else...if you could mod this and make the code that you add in bold so I can see it, that would be appreciated.

<?
$company_name = $_REQUEST['company_name'] ;
$first_name = $_REQUEST['first_name'] ;
$last_name = $_REQUEST['last_name'] ;
$title = $_REQUEST['title'] ;
$address = $_REQUEST['address'] ;
$city = $_REQUEST['city'] ;
$state = $_REQUEST['state'] ;
$zip = $_REQUEST['zip'] ;
$phone = $_REQUEST['phone'] ;
$email = $_REQUEST['email'] ;
$hearaboutus = $_REQUEST['hearaboutus'] ;
$number_of_employee = $_REQUEST['number_of_employee'] ;
$industry = $_REQUEST['industry'] ;
$description = $_REQUEST['description'] ;
mail("[email protected]","Contact Request"," Contact name: $company_name\n First Name: $first_name\n Last Name: $last_name\n Title: $title\n Address: $address\n City: $city\n State: $state\n Zip: $zip\n Country: $country\n Phone: $phone\n Email: $email\n Hear about us: $hearaboutus\n Number of Employees: $number_of_employee\n Industry: $industry\n Comments: $description");
?>
<script>
<!--
window.location= "/home.html"
//-->
</script>
<?php
exit;?>

 

[Barrucadu]

<?php
//The script will ONLY send the email if all the values are sent, and none of them are empty

if(isset($_REQUEST['company_name'])&&!empty($_REQUEST['company_name'])&&
isset($_REQUEST['first_name'])&&!empty($_REQUEST['first_name'])&&
isset($_REQUEST['last_name'])&&!empty($_REQUEST['last_name'])&&
isset($_REQUEST['title'])&&!empty($_REQUEST['title'])&&
isset($_REQUEST['address'])&&!empty($_REQUEST['address'])&&
isset($_REQUEST['city'])&&!empty($_REQUEST['city'])&&
isset($_REQUEST['state'])&&!empty($_REQUEST['state'])&&
isset($_REQUEST['zip'])&&!empty($_REQUEST['zip'])&&
isset($_REQUEST['phone'])&&!empty($_REQUEST['phone'])&&
isset($_REQUEST['email'])&&!empty($_REQUEST['email'])&&
isset($_REQUEST['hearaboutus'])&&!empty($_REQUEST['hearaboutus'])&&
isset($_REQUEST['number_of_employee'])&&!empty($_REQUEST['number_of_employee'])&&
isset($_REQUEST['industry'])&&!empty($_REQUEST['industry'])&&
isset($_REQUEST['description'])&&!empty($_REQUEST['description'])){
     $company_name = $_REQUEST['company_name'];
     $first_name = $_REQUEST['first_name'];
     $last_name = $_REQUEST['last_name'];
     $title = $_REQUEST['title'];
     $address = $_REQUEST['address'];
     $city = $_REQUEST['city'];
     $state = $_REQUEST['state'];
     $zip = $_REQUEST['zip'];
     $phone = $_REQUEST['phone'];
     $email = $_REQUEST['email'];
     $hearaboutus = $_REQUEST['hearaboutus'];
     $number_of_employee = $_REQUEST['number_of_employee'];
     $industry = $_REQUEST['industry'];
     $description = $_REQUEST['description'];
     mail("[email protected]","Contact Request"," Contact name: $company_name\n First Name: $first_name\n Last Name: $last_name\n Title: $title\n Address: $address\n City: $city\n State: $state\n Zip: $zip\n Country: $country\n Phone: $phone\n Email: $email\n Hear about us: $hearaboutus\n Number of Employees: $number_of_employee\n Industry: $industry\n Comments: $description");
}

header('Location: home.php');
?>

 

[rkahn144]

Mikor - thanks for the post.

The fields that we require in the HTML contact form are:
company_name
first_name
last_name
address
city
state
phone
email

Is there a way that the php form that you posted could be modded for this?

 

[Barrucadu]

Done

<?php 
//The script will ONLY send the email if all the values are sent, and none of them are empty 

if(isset($_REQUEST['company_name'])&&!empty($_REQUEST['company_name'])&& 
isset($_REQUEST['first_name'])&&!empty($_REQUEST['first_name'])&& 
isset($_REQUEST['last_name'])&&!empty($_REQUEST['last_name'])&& 
isset($_REQUEST['address'])&&!empty($_REQUEST['address'])&& 
isset($_REQUEST['city'])&&!empty($_REQUEST['city'])&& 
isset($_REQUEST['state'])&&!empty($_REQUEST['state'])&& 
isset($_REQUEST['phone'])&&!empty($_REQUEST['phone'])&& 
isset($_REQUEST['email'])&&!empty($_REQUEST['email'])){ 
     $company_name = $_REQUEST['company_name']; 
     $first_name = $_REQUEST['first_name']; 
     $last_name = $_REQUEST['last_name']; 
     $title = $_REQUEST['title']; 
     $address = $_REQUEST['address']; 
     $city = $_REQUEST['city']; 
     $state = $_REQUEST['state']; 
     $zip = $_REQUEST['zip']; 
     $phone = $_REQUEST['phone']; 
     $email = $_REQUEST['email']; 
     $hearaboutus = $_REQUEST['hearaboutus']; 
     $number_of_employee = $_REQUEST['number_of_employee']; 
     $industry = $_REQUEST['industry']; 
     $description = $_REQUEST['description']; 
     mail("[email protected]","Contact Request"," Contact name: $company_name\n First Name: $first_name\n Last Name: $last_name\n Title: $title\n Address: $address\n City: $city\n State: $state\n Zip: $zip\n Country: $country\n Phone: $phone\n Email: $email\n Hear about us: $hearaboutus\n Number of Employees: $number_of_employee\n Industry: $industry\n Comments: $description"); 
} 

header('Location: home.php'); 
?>

 

[Eric]

1.) Do not use $_REQUEST, use the proper $_POST or $_GET
2.) Here's another way:

<?php

// Array of field name => required (true or false)
$fields = array(
	'company_name'       => true,
	'first_name'         => true,
	'last_name'          => true,
	'address'            => true,
	'city'               => true,
	'state'              => true,
	'phone'              => true,
	'email'              => true,
	'zip'                => false,
	'country'            => false,
	'hearaboutus'        => false,
	'number_of_employee' => false,
	'industry'           => false,
	'description'        => false
);

$empty = array();

foreach ($fields AS $field => $required)
{
	if (($required) AND (!isset($_POST[$field]) OR empty($_POST[$field]))
	{
		$empty[$field] = 1;
	}
}

//The script will ONLY send the email if all the values are sent, and none of them are empty 
if(count($empty) == 0)
{
	foreach ($fields AS $field => $required)
	{
		$$field = trim(stripslashes(strip_tags($_POST[$field])));
	}

	mail("[email protected]","Contact Request"," Contact name: $company_name\n First Name: $first_name\n Last Name: $last_name\n Title: $title\n Address: $address\n City: $city\n State: $state\n Zip: $zip\n Country: $country\n Phone: $phone\n Email: $email\n Hear about us: $hearaboutus\n Number of Employees: $number_of_employee\n Industry: $industry\n Comments: $description");
}

header('Location: home.php');
exit;

?>