Formmail feedback form not including senders name or email

formmail form not including senders name or email

[Lorel]

I have formmail.pl with captcha set up on a site and it is being sent out and it gets to the site owner's email but goes into the spam mail box because the feedback form is not including the senders name or email which are both specified as "must be filled in" in the form.

I'm assuming there is a problem with whatever computer/browser they are using.

Does anyone know what might be wrong?

[NickMNS]

How or simply are the required fields validated and based on what criteria?

If the fields can have any value, then maybe the user is entering a or many white spaces. Then after submittal those characters are trimmed from the input as the values are processed.
Also check if the required fields are required for the forms submit or for the captcha. It could also be that the user is deleting the form entries after validating the captcha but before pressing submit.

[Lorel]

I will ask the user to fill out the form and take a screen shot and send it to me before submitting.

Here is the data at the top of the form

<FORM METHOD=POST ACTION="http://www.example.com/cgi-bin/formmail/FormMail.pl">
<input type=hidden name="recipient" value="[e-mail]">
<input type=hidden name="required" value="name,phone">
<input type=hidden name="subject" value="contact us">
<input type=hidden name="redirect" value="http://www.example.com/thank-you.htm">
<input type=hidden name="print_config" value="name, email">

<label>Name:<span class="redbold">*</span></label>
<input name="name" placeholder="name" type="text" width="100px;">

<label>Email:</label>
<input name="email" placeholder="[e-mail]" type="text">

<label>Phone:<span class="redbold">*</span></label>
<input name="phone" placeholder="Phone" type="text">

----other inputs left out ---

<img src="http://www.example.com/cgi-bin/formmail/captcha.cgi"><br>
<input type="text" name="verifytext">
<br>
<div class="center">
<input type="submit" name="submit" value="Submit">
<input type="reset" name="reset" value="Reset">
</div>
</form>
</div>

[NickMNS]

Things that jump out at me are:

<label>Email:</label> 
<input name="email" placeholder="[e-mail]" type="text"> 

Type should be email for this field. The fact that it is text means that any text string can be entered. I assume that your "FormMail" script is validating the value once submitted, but this still allows a form to be submitted with any text string including a white space. If you change type to email, then the html5 form validation will kick in and the browser will not allow the form to be submitted if the field is not an email (ie: containing @ symbol)


Same situation here:

<label>Phone:<span class="redbold">*</span></label> 
<input name="phone" placeholder="Phone" type="text"> 

Use type="tel"

[Lorel]

I'm not sure what you mean by validating, however, before I set up a thank you page I was getting the canned reply from formmail indicating it was sent off.

I changed the type data and waiting to hear back from the other person. However, this was a redesign so I had used the same "type" in input fields as before (being as they were working before the redesign). I only changed the layout.

Could it be because the doc type has changed that those old "types" will no longer work?

[not2easy]

When I'm testing things that involve emails and forms, I send it from one domain to another so I can instantly see what would be received and know what the client settings are. Can't always be done that way, just a tip in case it is an option for this testing.

[Lorel]

As far as I know the email recipient on formmail needs to have an email on the same domain. I didn't realize this would take so long otherwise I would have requested one.

[Lorel]

I did some research and a lot of testing, making sure the code in the form is HTML5 compliant being as I'm using (!DOCTYPE html), i.e., email type="email" and phone type="tel", and resent the form and this time left off the redirect to another page so it would give me the form feedback data.

I took a screen shot of form feedback data and sent to the site owner to let them know the form was sent and what was sent out and by the time they get it in their email program (Windows Outlook) it has stripped out the email address and left the name off the top of form data so they have no way to send an email.

Does anyone know of what might be happening with Outlook to mess up the feedback form?

[robzilla]

Have you consulted the documentation [scriptarchive.com]? For one, Formmail does not recognize a "name" input field, only "realname". "This field is useful for identification purposes and will also be put into the From: line of your message header." There are also some important security considerations in the documentation to prevent abuse of the form as much as possible. Know that putting the e-mail address of the recipient in the form code will expose it to e-mail address harvesters (bots) and, consequently, result in unsollicited e-mails.

[Lorel]

I didn't think to look in the documentation, so thanks. I've been consulting HTML5 changes for forms. The documentation is behind the times where the email type="text" however. It's supposed to be type="email" for html5. And from what I understand in HTML5 you can now put "required" in input tag instead of a separate line in hidden input tags.

For recipient should I just include the domain name? The form has captcha plus I have another method to prevent bots to manipulate the form -- once I get it working.

[Lorel]

Also the formmail version on this site is 1.92. the documentation you linked to is 1.93. Should I upgrade?

[Lorel]

I just tested the form after taking out the email address of the recipient out of the hidden input tag, and it gave me a bad/no recipient. Is this because it needs to be version 1.93?

[robzilla]

The "type" attribute tells the browser how to interact with the input field. A field of the "email" type may trigger the browser's auto-complete feature, for example, so that the e-mail address is automatically filled in, and the "required" attribute may trigger a browser's built-in form validation features so that the user can't post the form unless the required fields are filled. So basically these are directives for the client side, whereas fields like "realname" and "recipient" tell the script (server-side) how and where to send the e-mail after a form submission.

Unfortunately, I think the recipient e-mail address needs to be in the "recipient" hidden field for the script to work without modification. It could be hard-coded into the Formmail.pl script, so that you no longer need to use the "recipient" hidden field, but that will require some minor changes to the Perl code (and I don't speak Perl). Without that, at the very least I would set a value for the "@recipients" variable in Formmail.pl so that the form can only be used to send e-mail to one (or multiple) recipient(s) of your choosing.

@recipients = ('^yourself\@yourdomain\.com');

As for the version, at the bottom of the documentation you can find a history of releases, and it looks like version 1.93 fixed a security issue: "Removed cross-site scripting and header injection/ http response splitting vulnerabilities from redirect and return_link_url fields." So it's probably a good idea to get the latest version (even though that, too, is almost 9 years old).

[Lorel]

I did as you suggested above except for upgrading as it's not available in the site manager. I'm going to have the owner upgrade to a cpanel once we get these contact forms working.

I also, as a test, put the required items back in a hidden input tag (realname, email, phone, verifytext) and took "required" out of the related input tags. I then got a "no file found for verification."

Then for another test I removed Captcha and took "required" out of the 3 input tags, and put the required items in the hidden required tag and now I get: "email was left blank".

I tried several different combinations and always got the "email left out" error.

This form was working right before the redesign (responsive) so I put the old doc type back in and and the old contact form code (in tables) with captcha and this time it went through - at least it was sent off.

[robzilla]

"No file found for verification" will be a CAPTCHA error. A temporary text file is created and stored somewhere for each CAPTCHA so that the script can check the input against the solution.

It all sounds quite buggy to me, and I'd be inclined to look for a newer (PHP?) script, preferably one that's more recent or even still being updated.

[Lorel]

Can't remember if I said this but the forms were working before the redesign (HTML4) so I switched everything back to HTML4 and the old form data and everything works now. Apparently Formmail 1.92 doesn't work on html5 and this site is on a site manager account so I can't upgrade to 1.93.

Anyway it's working now. thanks for your help Robzilla.

[robzilla]

You did mention it, but switching from HTML4 to HTML5 shouldn't really have any effect on how a form is submitted. Formmail.pl, old as it is, does have a few quirks, so that's why I recommended finding an alternative, but if it's working to your satisfaction now then I can imagine you would just like to leave it at that :-)