Forum Moderators: coopster
<?php include('vdaemon/vdaemon.php');?>
<html>
<head>
<title>Quick Contact Form Sample</title>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<link href="samples.css" rel="stylesheet" type="text/css">
</head>
<body>
<h1>Quick Contact Form Sample</h1>
<form method="POST" name="QContact" runat="vdaemon" action="qcontact_p.php">
<table cellpadding="0" cellspacing="0" border="0">
<tr>
<td width="100">
<vllabel form="QContact" validators="NameReq" errclass="error">Name:</vllabel>
</td>
<td width="220">
<input name="Name" type="text" class="control" size="20">
<vlvalidator name="NameReq" type="required" control="Name" errmsg="Name required" clientvalidate="true">
</td>
<td width="300" rowspan="5" valign="top">
<vlsummary class="error" headertext="Error(s) found:" displaymode="bulletlist">
</td>
</tr>
<tr>
<td>
<vllabel form="QContact" validators="EmailReq,Email" errclass="error">E-mail:</vllabel>
</td>
<td>
<input name="Email" type="text" class="control" size="20">
<vlvalidator name="EmailReq" type="required" control="Email" errmsg="E-mail required">
<vlvalidator name="Email" type="email" control="Email" errmsg="Invalid E-mail" clientvalidate="true">
</td>
</tr>
<tr>
<td colspan="2">
<vllabel form="QContact" validators="MessageReq" errclass="error">Message/Question:</vllabel>
</td>
</tr>
<tr>
<td colspan="2">
<textarea name="Message" cols="40" rows="7" wrap="virtual" class="control"></textarea>
<vlvalidator name="MessageReq" type="required" control="Message" errmsg="Message required" clientvalidate="true">
</td>
</tr>
<tr>
<td colspan="2">
<input type="submit" class="control" value="Send">
<input type="reset" class="control" value="Reset">
</td>
</tr>
</table>
</form>
</body>
</html>
[webmasterworld.com...]
lukasz:
Even if you have done client side verification with JavaScript you should still verify server side also - you must never trust anything coming from the client!
As a particular warning in this case; I don't know which method is being used to send the email; but if it is a case of constructed text being piped to sendmail then there is the possibility for an attacker to inject shell commands (similar to SQL injection) if nothing is done to protect against it!
// Check for valid email
function api_is_email($input)
{
if ($input)
{
if (eregi("^[-a-z0-9_][-a-z0-9_.]*\@[-a-z0-9]+(\.[-a-z0-9]+)*\.(com¦edu¦gov¦int¦mil¦net
¦org¦biz¦info¦name¦museum¦coop¦aero¦[a-z][a-z])$", $input)) return 1;
}
}
[edited by: jatar_k at 5:50 pm (utc) on Dec. 15, 2003]
[edit reason] broke line for sidescroll [/edit]
<form action="********.php" method="POST" onsubmit="return check form(this)" name="myform" language="JavaScript">
Have you told it to? Something like:
header("Location: /thankyoupage.html");
will do the trick - but only trigger it if the form validates!
PART: 1 Include following script in your head tags
<HEAD>
<SCRIPT LANGUAGE="JavaScript">
function checkFields() { // field validation -
if ( (document.emailform.name.value=="") ¦¦ // checks if fields are blank.
(document.emailform.email.value=="") ¦¦ // checks if fields are blank.
(document.emailform.phone.value=="") ¦¦ // checks if fields are blank.
(document.emailform.comments.value=="") ) // checks if fields are blank.
{
alert("Please enter your name, phone, email, and comments then re-submit this form.");
return false;
}
</SCRIPT>
</HEAD>
PART:2 INLCUDE ON SUBMIT IN <BODY> <FORM> TAG
<BODY>
... ... ...
<form action="ANY" method="ANY" onSubmit="return checkFields()" name="NAME OF YOUR FORM">
... ... ...
</BODY>
HOPE, THIS WILL SERVE YOUR PURPOSE.
BEST LUCK!
JavaScript is a good way to validate the form because it happens more immediately since there is no interaction with the server, but you may want to include PHP validation also.
You said you are getting a lot of blank submissions.. I've gotten the same thing before, and in checking my logs, I've found that most of these come through from bots. The problem here is that a bot is unlikely to understand the JavaScript. It will most likely suck the URL from the action="..." parameter and follow it causing a blank submission.
So on my site, I've implemented both. This makes it easy and friendly for users who have accidentally missed something, but verifies everything on the backend as well in case someone tries to circumvent the JavaScript (or has it disabled).
