Jem

Using SSL is not going to prevent the shop from being hacked. Suggesting this is quite misleading IMO.

Sorry, I wasn't specific, I meant what's the mail provider of the recipient address; e.g. gmail, yahoo, or through your own domain (which I guess is what you're saying ) I ask because it's easy to whitelist certain incoming mail through some providers. If you're having these mails sent to an account hosted through your domain, is SpamAssassin enabled on the account?

It happens sometimes. I need more details - what mail provider are you using?

No, that's perfectly fine.

Hehe, it's ok, I'm only messing

You seem to have already put the code into contact.php? As long as I have that right, it will work from there

You won't see PHP when you view source because it's parsed before it reaches the browser - that means that PHP is doing its job I've just had a look at your contact.php and it still says mail_form_v2.php in the form: <form action="mail_form_v2.php" method="post"> This needs changing to: <form action="contact.php" method="post">

PHP is processed by the server before it reaches the browser - that means the files you've linked to are of no use to us whatsoever. Anyway, captcha issues are normally down to not having the right PHP graphics library.

I was going to link you to Chris Shiftlett's article on it yesterday but every time I went to his blog it tried to show me any other blog entry than the one I wanted. Sorry I couldn't back that up with a little more background data Glad you found the info though.

Two suggestions: 1) use mysql_real_escape_string() instead of addslashes 2) sanitise the IP as well - certain parts of $_SERVER are just as manipulatable as $_POST/etc

I don't have an installed copy of Joomla to hand to answer the first one, but a bespoke e-commerce solution with over 1000 products (and 10 different price lists stacking up over 10k records; cart details at over 14k records) that I made for a work client is only using 2MB. Another example... my 7 year old blog with over 18,000 comments and nearly 1,000 entries is only using about 10MB. Most hosts offer multiple GB of database space. That's quite a lot

If the make and model are going in, it sounds like if (strrpos($theData, "£") === false ) { is always reporting false. Your echo "hello"; - does that ever echo hello?

Are you asking which should you use out of htmlspecialchars and strip_tags? Both. strip_tags first to get rid of any html, then htmlspecialchars to deal with any left over stray characters ( < > & etc). If you're working with a database you should also use mysql_real_escape_string (or prepared statements). With regards to other common attacks, I have some good bookmarks here: http://delicious.com/jemjabella/security Ps. less of the 'chaps' if you don't mind

Again, the OP did state that it's not just phpinfo() not working. If PHP isn't set up properly the PHP version will display in cpanel but it doesn't necessarily mean anything. Jo needs to get in touch with his/her host.

This was specified in the first post