Forum Moderators: coopster

Message Too Old, No Replies

Form Question

From an extreme newbie

         

EarleyGirl

8:59 pm on Jan 3, 2006 (gmt 0)

10+ Year Member



I use a contact form PHP script from thesitewizard website. Does anyone know if this script is fairly secure from hackers? I emailed the author many moons ago but received no response.

The reason I ask is not because I feel it's been hacked but because our host sent an email out to all customers about PHP/Perl contact scripts - recommending only one script - not the one I'm using. So, I was just hoping one of you there is familiar with the script I'm referring to (by Christopher Heng) and can help.

I didn't know if I could post the script here but would be happy to sticky someone or post it if it's allowed. It's quite simple but effective. I have it on a few sites and don't really want to replace it if not absolutely necessary.

Thanks,

Hope

inveni0

10:27 pm on Jan 3, 2006 (gmt 0)

10+ Year Member



What is the site address?

EarleyGirl

10:53 pm on Jan 3, 2006 (gmt 0)

10+ Year Member



What is the site address?

[thesitewizard.com...]

EarleyGirl

12:36 am on Jan 4, 2006 (gmt 0)

10+ Year Member



What is the site address?

inveni0 - did you ask because you were going to take a look at the code or did you just want a contact script?

Can anyone else help? Should I post the code?

inveni0

1:17 am on Jan 4, 2006 (gmt 0)

10+ Year Member



To look at the code. Can you post it?

EarleyGirl

1:59 am on Jan 4, 2006 (gmt 0)

10+ Year Member



The copyright says I can't republish it. I'll sticky with more info.

Thanks.

topsites

10:03 am on Jan 4, 2006 (gmt 0)



Here is something you can use, it is on hotscripts.com, I put the code here (next 3-4 posts, hope it works lol)

Two files in root (or sub-directory of your choice):
config.php: (You must edit where your email)

<?php
//Mail Me - Copyright 2005 syndikut.org
//Please do not remove copyright if you use this script
$ademail = "youremail@yerdomaine.com"; // your email
?>

And email.php:

<?php
extract($HTTP_GET_VARS);
extract($HTTP_POST_VARS);
if ($action == "send")
{
include("config.php");
$to = $ademail;
$from = $_POST['from'];
$name = $_POST['fullname'];
$subject = $_POST['subject'];
$message = $_POST['message'];

$to = trim($to);
$from = trim($from);
$name = trim($name);
$subject = trim($subject);
$message = trim($message);

if (empty($to))
{
$ermessage = "Error: Email address to can not be blank, Please enter your email address in the config file!";
include("_inc/email_error.htm"); exit();
}
if (empty($from))
{
$ermessage = "Error: Email address can not be blank, Please enter your email address!";
include("_inc/email_error.htm"); exit();
}
if (!ereg('^[-!#$%&\'*+\\./0-9=?A-Z^_`a-z{¦}~]+'.
'@'.
'[-!#$%&\'*+\\/0-9=?A-Z^_`a-z{¦}~]+\.'.
'[-!#$%&\'*+\\./0-9=?A-Z^_`a-z{¦}~]+$', $from))
{
$ermessage = "Error: Invalid Email address, Please re-enter your email address!";
include ("_inc/email_error.htm"); exit;
}
if (empty($name))
{
$ermessage = "Error: Please enter your name!";
include("_inc/email_error.htm"); exit();
}
if (empty($subject))
{
$ermessage = "Error: Subject can not be blank, Please enter email subject";
include("_inc/email_error.htm"); exit();
}
if (empty($message))
{
$ermessage = "Error: Message body can not be blank, Please enter email message";
include("_inc/email_error.htm"); exit();
}
$footer = "\n_______________________________________\nMail Me!, php script by [syndikut.org\nCopyright...] 2005 Syndikut.org";
$message = $message."\n".$footer;
$send = mail($to, $subject, $message, "From: {$from}");
if ($send)
{
include("_inc/email_sent.htm"); exit();
}
else
{
$ermessage = "Error: You message has not been sent, please try again";
include("_inc/email_error.htm"); exit();
}
}
else
{
include("_inc/email.htm");
}
?>

[edited by: topsites at 10:08 am (utc) on Jan. 4, 2006]

topsites

10:04 am on Jan 4, 2006 (gmt 0)



Then, create a sub-directory called:
_inc

(As in- yoursite.com/_inc/ )
In that directory, place:

email.htm

<html>
<head>
<title></title>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1"></head>
<body text="#000000" link="#000000" vlink="#000000" alink="#000000" leftmargin="0" bottommargin="0" rightmargin="0" topmargin="0" marginwidth="0" marginheight="0">
<table width="100%" height="100%" cellpadding="1" cellspacing="1">
<tr>
<td height="442"><div align="center">
<h4 align="center">&nbsp;</h4>
<h4 align="center"><font size="2" face="Verdana, Arial, Helvetica, sans-serif">Contact
Us :</font></h4>
<p align="center"><font color="#333333" size="2" face="Verdana, Arial, Helvetica, sans-serif">Please
fill in the form below to contact us!</font></p>
<form action="email.php?action=send" method="post">
<table width="50%">
<tr>
<td width="110"><div align="right"><font color="#000000" size="2" face="Verdana, Arial, Helvetica, sans-serif">Email:</font></div></td>
<td width="260"><font size="2" face="Verdana, Arial, Helvetica, sans-serif">
<input name="from" type="text" id="from">
</font></td>
</tr>
<tr>
<td><div align="right"><font color="#000000" size="2" face="Verdana, Arial, Helvetica, sans-serif">Name:</font></div></td>
<td><font size="2" face="Verdana, Arial, Helvetica, sans-serif">
<input type="text" name="fullname">
</font></td>
</tr>
<tr>
<td><div align="right"><font color="#000000" size="2" face="Verdana, Arial, Helvetica, sans-serif">Subject:</font></div></td>
<td><font size="2" face="Verdana, Arial, Helvetica, sans-serif">
<input name="subject" type="text" id="subject">
</font></td>
</tr>
<tr>
<td height="136"><div align="right">
<p><font size="2" face="Verdana, Arial, Helvetica, sans-serif">Message:</font></p>
<p>&nbsp;</p>
<p>&nbsp;</p>
<p>&nbsp;</p>
</div></td>
<td><textarea name="message" rows="7" id="message"></textarea>
<font size="2" face="Verdana, Arial, Helvetica, sans-serif">&nbsp;</font></td>
</tr>
</table>
<p>
<input type="submit" value="Send">
</p>
</form>
<p><font color="#FF0000" size="1" face="Verdana, Arial, Helvetica, sans-serif">All
fields Required</font><font size="1" face="Verdana, Arial, Helvetica, sans-serif">
</font></p>
<p>&nbsp;</p>
</div></td>
</tr>
</table>
</body>
</html>

topsites

10:05 am on Jan 4, 2006 (gmt 0)



Also in _inc, put:
email_error.htm

<html>
<head>
<title></title>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1"></head>
<body text="#000000" link="#000000" vlink="#000000" alink="#000000" leftmargin="0" bottommargin="0" rightmargin="0" topmargin="0" marginwidth="0" marginheight="0">
<table width="100%" height="100%" cellpadding="1" cellspacing="1">
<tr>
<td height="442"><div align="center">
<h4 align="center">&nbsp;</h4>
<h4 align="center"><font size="2" face="Verdana, Arial, Helvetica, sans-serif">Contact
Us :</font></h4>
<p align="center"><font color="#333333" size="2" face="Verdana, Arial, Helvetica, sans-serif">Please
fill in the form below to contact us!</font></p>
<p align="center"><font color="#ff0000" size="2" face="Verdana, Arial, Helvetica, sans-serif"><?php echo $ermessage;?></font></p>
<form action="email.php?action=send" method="post">
<table width="50%">
<tr>
<td width="110"><div align="right"><font color="#000000" size="2" face="Verdana, Arial, Helvetica, sans-serif">Email:</font></div></td>
<td width="260"><font size="2" face="Verdana, Arial, Helvetica, sans-serif">
<input name="from" type="text" id="from" value="<?php echo $from;?>">
</font></td>
</tr>
<tr>
<td height="26"><div align="right"><font color="#000000" size="2" face="Verdana, Arial, Helvetica, sans-serif">Name:</font></div></td>
<td><font size="2" face="Verdana, Arial, Helvetica, sans-serif">
<input name="fullname" type="text" value="<?php echo $name;?>">
</font></td>
</tr>
<tr>
<td><div align="right"><font color="#000000" size="2" face="Verdana, Arial, Helvetica, sans-serif">Subject:</font></div></td>
<td><font size="2" face="Verdana, Arial, Helvetica, sans-serif">
<input name="subject" type="text" id="subject" value="<?php echo $subject;?>">
</font></td>
</tr>
<tr>
<td height="136"><div align="right">
<p><font size="2" face="Verdana, Arial, Helvetica, sans-serif">Message:</font></p>
<p>&nbsp;</p>
<p>&nbsp;</p>
<p>&nbsp;</p>
</div></td>
<td><textarea name="message" rows="7" id="message"><?php echo $message;?></textarea>
<font size="2" face="Verdana, Arial, Helvetica, sans-serif">&nbsp;</font></td>
</tr>
</table>
<p>
<input type="submit" value="Send">
</p>
</form>
<p><font color="#FF0000" size="1" face="Verdana, Arial, Helvetica, sans-serif">All
fields Required</font><font size="1" face="Verdana, Arial, Helvetica, sans-serif">
</font></p>
<p>&nbsp;</p>
</div></td>
</tr>
</table>
</body>
</html>

topsites

10:05 am on Jan 4, 2006 (gmt 0)



And last but not least, put in _inc :
email_sent.htm

<html>
<head>
<title></title>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1"></head>
<body text="#000000" link="#000000" vlink="#000000" alink="#000000" leftmargin="0" bottommargin="0" rightmargin="0" topmargin="0" marginwidth="0" marginheight="0">
<table width="100%" height="100%" cellpadding="1" cellspacing="1">
<tr>
<td height="346">
<div align="center">
<h4 align="center"><font color="#00CC00" size="2" face="Verdana, Arial, Helvetica, sans-serif">Thank
You </font></h4>
<p align="center"><font color="#333333" size="2" face="Verdana, Arial, Helvetica, sans-serif">Your
email has been sent!</font></p>
<p>&nbsp;</p>
<p>&nbsp;</p>
<p>&nbsp;</p>
<p>&nbsp;</p>
<p>&nbsp;</p>
<p>&nbsp;</p>
<p>&nbsp;</p>
</div></td>
</tr>
</table>
</body>
</html>

EarleyGirl

4:27 pm on Jan 4, 2006 (gmt 0)

10+ Year Member



Thanks topsites. So this is fairly secure, then?