Welcome Guest ( Log In | Register)



2 Pages V  < 1 2  
 Reply to this topicStart new topic
> Using A Php Contact Form, Please Help!
Lozbo
post Mar 31 2006, 12:47 AM
Post #11


Super Member
*********

Group: Members
Posts: 282
Joined: 1-September 05
From: Wanatos
Member No.: 11,382
Yes, Tyseen knows what he speaks about! hehe, so Tyssen, do you have any secure validating script you can share? i have not checked those pages you posted gaea, they are opening as i type... thanks!

(list)

Go to the top of the page
 
+Quote Post
Tyssen
post Mar 31 2006, 01:44 AM
Post #12



***********

Group: Members
Posts: 1,161
Joined: 9-May 05
From: Brisbane, QLD
Member No.: 6,818
I'm using this one: http://www.surefirewebdesign.com/scripts/

It's not free though.

(list)

Go to the top of the page
 
+Quote Post
gaea
post Mar 31 2006, 06:01 AM
Post #13


Super Member
*********

Group: Members
Posts: 205
Joined: 14-March 06
From: Vermont or Boston (USA)
Member No.: 20,077
QUOTE(Tyssen @ Mar 29 2006, 05:48 AM) *

Couple of problems with your script gaea:
1. It doesn't check the input for email header injection attempts and clean it before processing.
2. If there are errors in the form, it returns the user to an empty form with no error messages to let them know what is wrong.


Both of these are good points (though the script *does* return error messages...so im not quite sure where you got that from). Adding the origonal information back into the form would take about 2 seconds worth of time, and so is deffinatly worth doing.

As far as header injection attempts...that is also a good point. But where do you stop? There are sssooooo many possible exploits that if you wanted to write a 100% secure script it'd take you a rather long time. What would you say qualifies as "good enough?" Removing any occurances of "\r" or "\n?" And 0x0D/%0D, and %0A? Or stopping all the MIME vulnerabilites? Or other vunrabilities that randomly appear on the net? Where do you draw the line?

Also, no offence, but paying money to use a feedback form script seems rather ludacris to me. Except if you are really desperate and don't know how to write your own code.

----------
EDITED:
----------

Anyways, after a little work i added both of your suggestions to my script. It only protects against the From field being exploited by "\r", "\n?", "0x0D/%0D", and "%0A". Which means that it isn't 100% secure...but should stop virtually all attempts to use the form to send email to other people instead of (or as well as) the origonal hard coded email adderess. Which means that your feedback form can't be used by a spammer to send out unsollicited emails. I also had it email the spammer/hijacker's IP adderess back to you incase you wish to report them.

The new code is something like this:
(sendmail.php)
CODE
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html><head></head><body>
<table bgcolor="#ffffff" cellpadding="28"><tbody><tr><td>

<?php
$passedTests = "yes";
$Hijacked = "no";
$HijackAttempt=$visitormail;

   if (eregi("\r",$HijackAttempt) || eregi("\n",$HijackAttempt) || eregi("%0A",$HijackAttempt) || eregi("0x0D/%0D",$HijackAttempt))
   {
   $passedTests = "no";
   $Hijacked = "yes";}


    if($Hijacked == "yes"){
    echo "<font color='red'><h2>Email Header Injection Attempt Detected! &nbsp;Your IP Address has been logged, and will be reported shortly.</h2></font><br />";
    
    $todayis = date("l, F j, Y, g:i a");

    $subject = $subject;

    $subject2 = "EMAIL HEADER INJECTION ATTEMPT";

    $notes = stripcslashes($notes);

    $message = " $todayis \n
    EMAIL HEADER INJECTION ATTEMPT DETECTED from $visitor ($visitormail). \n
        IP Address = $ip \n
    Subject: $subject \n
    Message: $notes \n
    Browser Info: $httpagent \n";
    $from2 = "From: YOURNAME@YOURWEBSITE.COM\r\n";

    mail("YOURNAME@YOURWEBSITE.COM", $subject2, $message, $from2);
    }

if(!$visitormail == "" && (!strstr($visitormail,"@") || !strstr($visitormail,".")))
{
echo "<h2>The following error(s) were encountered:</h2>";
echo "<font color='red'>*Invalid email address. <br /></font>";
$passedTests = "no";
}
if(empty($visitor) || empty($visitormail) || empty($notes )) {
    if($passedTests == "yes"){
    echo "<h2>The following error(s) were encountered:</h2>";
    }
echo "<font color='red'>*Please fill in ALL of the required fields. <br /></font>";
$passedTests = "no";
}

$todayis = date("l, F j, Y, g:i a");

$subject = $subject;

$subject2 = "Feedback from YOURWEBSITE.COM";

$notes = stripcslashes($notes);

$message = " $todayis \n
From: $visitor ($visitormail)\n
Subject: $subject \n
Message: $notes \n
Additional Info : IP = $ip \n
Browser Info: $httpagent \n
";

$from = "From: $visitormail\r\n";

if($passedTests == "yes"){
mail("YOURNAME@YOURWEBSITE.COM", $subject2, $message, $from);
?>
<p align="center">
<h2>Thankyou for your feedback!</h2>
<center>

<br /><table border=0><tr><td>
Date: </td>
<td><?php echo $todayis ?></td></tr>
<tr><td>Name: </td>
<td><?php echo $visitor ?> ( <?php echo $visitormail ?> )</td></tr>
<tr><td>Subject: </td>
<td><?php echo $subject ?></td></tr>
<tr><td></td><td></td></tr>
<tr><td>Message: &nbsp;&nbsp;</td>
<td><?php $notesout = str_replace("\r", "<br/>", $notes);
echo $notesout; ?></td></tr></table></center>

</p>
<?php
}
else{
?>
<br /><form method="post" action="sendmail.php">

<?php
$ipi = getenv("REMOTE_ADDR");
$httprefi = getenv ("HTTP_REFERER");
$httpagenti = getenv ("HTTP_USER_AGENT");
?>

<input type="hidden" name="ip" value="<?php echo $ipi ?>" />
<input type="hidden" name="httpref" value="<?php echo $httprefi ?>" />
<input type="hidden" name="httpagent" value="<?php echo $httpagenti ?>" />
<center>
<table border=0<tbody><tr align=left><td>
<font color="red">*</font>Name: </td>
<td><input type="text" name="visitor" size="51" value="<?php echo $visitor ?>" /></td></tr>
<tr align=left><td><font color="red">*</font>Email: </td>
<td><input type="text" name="visitormail" size="51" value="<?php echo $visitormail ?>" /></td></tr>
<tr align=left><td>&nbsp;Subject: </td>
<td><input type="text" name="subject" size="51" value="<?php echo $subject ?>" /></td></tr>
<tr align=left><td><font color="red">*</font>Message: &nbsp;&nbsp;</td>
<td><textarea name="notes" rows="7" cols="50"><?php echo $notes ?></textarea></td>
<tr align=left><td></td><td align="center"><input type="submit" value="Send Mail" /></td></tr></tbody></table></center>
</form>
<?php
}

?>
<p>&nbsp;</p>
</td></tr></tbody></table></body></html>


Once again, Don't forget to change YOURNAME@YOURWEBSITE.COM to your actual email adderess.

If you have any other requests/suggestions I'd be happy to attempt to impliment them or help you do it yourself.

This post has been edited by gaea: Mar 31 2006, 07:44 AM

(list)

Go to the top of the page
 
+Quote Post
« Next Oldest · HTML, XML etc.. · Next Newest »
 

2 Pages V  < 1 2
Reply to this topicStart new topic

Collapse

> Similar Topics

Topics Topics
  1. What Is A Computer Form Factor(1)
  2. Perl For Automated Web Form Search(1)
  3. Have Diferences Of Performance Form Ps2 Full Console To Mini-ps2?(8)
  4. Free Windowsxp Sp2 Cd From Microsoft(12)
  5. Vb 2008 Linking To Another Form..(0)
  6. Form To Php Mail. Attachment(14)
  7. *** Click Here To Get Your Free Hosting ***(1)
  8. Html Form!(4)
  9. Application Form [approved](2)
  10. Gahhh This Isn't Going Well Please Help!(12)
  11. How To Make Form Nested In Internet Explorer ?(2)
  12. Loop Through Form(8)
  13. Registration Form?!(6)
  14. Help With Form Actions.(1)
  15. Contact.pl Confusion(0)
  1. How To Make A Search Form And Php Code?(10)
  2. Form Not Returning Correct Email Address(5)
  3. Advanced Contact Forum(0)
  4. I Liked This Form Builder(4)
  5. Brand New Motherboard Form Factor Coming Out?(2)
  6. Php Emailer/contact System(20)
  7. Updating Php File Through A Web Form(5)
  8. Choosing Colored Contact Lenses(1)
  9. Contact Lenses Or Glasses?(70)
  10. Problem With Java Script Popup Form(1)
  11. Controlling Differents Keypresses In A Single Form(0)
  12. Php Ftp Upload Form(0)
  13. I Have A Great Idea(3)
  14. Add A Javascript Feedback Form On Your Web Page(6)
  15. Best Way To Protect Html Form Fields(3)


 

Display Mode: Standard · Switch to: Linear+ · Switch to: Outline

Track this topic · Email this topic · Print this topic · Subscribe to this forum

- Lo-Fi Version Time is now: 29th August 2008 - 12:20 AM
Powered By IP.Board © 2008  IPS, Inc.
Licensed to: Xisto Corporation