Forum Moderators: coopster
<?php
$title = $_REQUEST['title'] ;
$name = $_REQUEST['name'] ;
$comments = $_REQUEST['comments'] ;
$email = $_REQUEST['email'] ;
//prevent email strings
if((strpos($name, '@')!==false) || strlen($email)>50 || strlen($name)>30 )
die();
//prevent bad strings
function contains_bad_str($str_to_test) {
$bad_strings = array(
"content-type:",
"mime-version:",
"multipart/mixed",
"Content-Transfer-Encoding:",
"bcc:","cc:",
"to:" );
foreach($bad_strings as $bad_string) {
if(eregi($bad_string, strtolower($str_to_test))) {
echo "$bad_string found. Suspected injection attempt - mail not being sent. If you are trying to inject spam or other junk unfortunately it will not work no Windows here.";
exit;
}
}
}
function contains_newlines($str_to_test) {
if(preg_match("/(%0A|%0D|\\n+|\\r+)/i", $str_to_test) != 0) {
echo "newline found in $str_to_test. Suspected injection attempt - mail not being sent. If you are trying to inject spam or other junk unfortunately it will not work no Windows here.";
exit;
}
}
contains_bad_str($name);
contains_bad_str($email);
contains_newlines($name);
contains_newlines($email);
if (!isset($_REQUEST['email'])) {
header( "Location: contact.html" );
}
elseif (empty($email)) {
header( "Location: noemail.html" );
}
mail( "mail@me.co.uk", "Site Report",
"$message\r\ntitle: $title\r\nname: $name\r\ncomments: $comments\r\nemail: $email",
"From: $name <$email>" );
header( "Location: thankyou.html" );
?>
title:
name:
comments:
email:
mail():
$message = trim($message);
if (empty($message)) {
echo "Message is empty - mail not being sent.";
exit;
}
