D&C GLug - Home Page

[ Date Index ] [ Thread Index ] [ <= Previous by date / thread ] [ Next by date / thread => ]

[LUG]Re: submit-message form on website

 
Hi Rich,

PHP web to email forms have a long and murky history - not helped by one of the most popular early ones being very easy to manipulate - and it was! I've no doubt it's still out there in many places and acting as an open relay for thousands of badly intentioned people. I certainly see bots searching for it on my web servers.

The technical side of writing a web form is really very easy, php has email built-in after all, or you can use a local or remote smtp server to send it.

Follow a few basic rules, and ensure you read up on php and web security first (there's lots of good guides out there so I won't repeat them badly here)

DO: Sanitise input.
DO: Hardcode the "To" address, always, to stop it being used as an open gateway.

It will be abused, of course, and almost instantly. Bots are crawling html constantly for any form elements and will try to send spam through them. Why not, it costs them nothing?

But generally - as with all things security - you can never be totally secure. If you have doubts, don't do it, or use one of the many freely available webforms,  even if they're commercially operated.

(The first example on your link is horrible - even if just because it doesn't hardcode the from. The first replier has fixed that.)

On Sun, 2 Jul 2023 at 00:27, rds_met <dcglug@xxxxxxxxxxxxxxx> wrote:
Hello all

I found suggested code here:
https://stackoverflow.com/questions/18379238/send-email-with-php-from-html-form-on-submit-with-the-same-script

I copied the coupled html-forms code and PHP code into the two
respective files.
With due edits for my individual details.

It seems to work perfectly.

Anyone comment how
* secure
* etc.
this is?

Best wishes,
Rich Smith

--
The Mailing List for the Devon & Cornwall LUG
FAQ: https://www.dcglug.org.uk/faq/
--
The Mailing List for the Devon & Cornwall LUG
FAQ: https://www.dcglug.org.uk/faq/