Feedback Form

By ZabuzaMomochi on Dec 30, 2006

Its a feedback form, so you know what your users think of your site, etc. on the 29th line, change 'nick@host.com' to your email address. This is my first php snippet, so please use constructive critisism.

<html>
<body>

<?php
function spamcheck($field)
  {
  if(eregi("to:",$field) || eregi("cc:",$field)) 
    {
    return TRUE;
    }
  else
    {
    return FALSE;
    }
  }

if (isset($_REQUEST['email']))
  {
  $mailcheck = spamcheck($_REQUEST['email']);
  if ($mailcheck==TRUE)
    {
    echo "Invalid input";
    }
  else
    { 
    $email = $_REQUEST['email'] ; 
    $subject = str_replace(array("\n","\r"),array('',''),$subject);
 $message = $_REQUEST['message'] ;
mail("name@host.com", "Subject: $subject",
base64_encode($message), "From: $email",'Content-Transfer-Encoding: base64' );
    echo "Thank you for using our mail form";
    }
  }
else
  {
  echo "<form method='post' action='mailform.php'>
  Email: <input name='email' type='text' /><br />
  Subject: <input name='subject' type='text' /><br />
  Message:<br />
  <textarea name='message' rows='15' cols='40'>
  </textarea><br />
  <input type='submit' />
  </form>";
  }
?>

</body>
</html>

Comments

Sign in to comment.
ZabuzaMomochi   -  Jan 01, 2007

Ah, i see. I just updated it! Thanks tye.

 Respond  
ZabuzaMomochi   -  Dec 31, 2006

Actually Hawkee, the \'email\' input field is telling the person who gets the email the person who sent the emails email address. Basically, if you changed the \'user@host.com\' to blah@blah.net and put the email blah@yahoo.com for the email, and blah for the subject and blah for the body it would send the subject, blah, the message, blah, and it would have \'From: theemailentered\' it also checks if the email is valid. :D

 Respond  
F*U*R*B*Y*   -  Dec 31, 2006

5/10 because you try hard :P

 Respond  
Hawkee   -  Dec 31, 2006

It\'s actually a very common exploit. There are bots that attempt to exploit contact forms constantly.

 Respond  
F*U*R*B*Y*   -  Dec 30, 2006

yes but who would know how to do that? :P

 Respond  
Hawkee   -  Dec 30, 2006

This code is exploitable. Somebody can add header information to the Subject field to send email to anybody they wish.

 Respond  
ZabuzaMomochi   -  Dec 30, 2006

Thanks. :D

 Respond  
F*U*R*B*Y*   -  Dec 30, 2006

not bad not bad... :P good job :P

 Respond  
Are you sure you want to unfollow this person?
Are you sure you want to delete this?
Click "Unsubscribe" to stop receiving notices pertaining to this post.
Click "Subscribe" to resume notices pertaining to this post.