Hi Folks,

 

I am using a modal form and im having some issues in getting the form to send data. See here - http://bucketboats.com. The contact script I am using is as follows -

 

<?php

$ToEmail = 'dan@definitelydomains.com';

$EmailSubject = 'BucketBoats';

$mailheader = "From: ".$_POST["email"]."\r\n";

$mailheader .= "Reply-To: ".$_POST["email"]."\r\n";

$mailheader .= "Content-type: text/html; charset=iso-8859-1\r\n";

$MESSAGE_BODY = "Name: ".$_POST["name"]."";

$MESSAGE_BODY .= "Email: ".$_POST["email"]."";

$MESSAGE_BODY .= "Offer: ".nl2br($_POST["offer"])."";

mail($ToEmail, $EmailSubject, $MESSAGE_BODY, $mailheader) or die ("Failure");

?>

 

The form setup is contained within the main index.html, and i have created a separate contact.php file where the above contact script is located.

 

Is something wrong with this? Do I need to add anything else?

 

I also have another document titled customer_message.txt which includes the following:

 

<?php

if(isset($_POST['email']) && isset($_POST['name']) && isset($_POST['offer'])){

 

$name = $_POST['name']."\r\n";

$email = $_POST['email']."\r\n";

$offer = $_POST['offer']."\r\n";

$message_date = date('d-m-Y H:i');

 

//-- your txt file name

$file = 'customer_message.txt';

 

//-- read the txt's content

$message = file_get_contents($file);

 

//-- add new message to txt file

$message .= "\r\n**** Message Date : ".$message_date." ****\r\n";

$message .= "Name : ".$name;

$message .= "Email : ".$email;

$message .= "Offer : ".$offer;

$message .= "**** End Of Message ****\r\n";

 

//-- write message

file_put_contents($file,$message);

 

//-- send success message

echo true;

}

else{

//-- send error message

echo false;

}

?>

 

Any help would be appreciated.

 

Dan

Edited March 29, 20179 yr by danbingham

Hi,

 

Thanks for your reply.

 

Once a user enters the data and hits the send message, it displays error. No data is captured, or received at the destination email. I wasn't sure if I'm missing something, or the current script needs tweeking?

 

Thanks,

 

Dan

Hi,

 

Please make sure you escape any input that a user has sent through $_POST (or $_GET or $_REQUEST) otherwise you'll find yourself in a whole world of hurt once a hacker has a stab at your website

What do I need to do to change this in the current script?

Edited March 30, 20179 yr by danbingham

The error displays if

 

(isset($_POST['email']) && isset($_POST['name']) && isset($_POST['offer']))

 

is false.

 

So it looks like you aren't passing all the $_POST data to the script.

 

You can sanitize the date in various ways. This is part of it: http://php.net/manual/en/filter.filters.sanitize.php

 

Also consider a honeypot and check to ensure the form isn't submitted too quickly.

Thanks.

 

This is all quite new to me so struggling a little in what I need to do to get this sorted. Not sure what you mean by honeypot, or sanitizing the data? Can you recommend any simple tweets I need to make?

 

Thanks for the comments so far.

 

Dan

Edited March 30, 20179 yr by danbingham

This is how to add a honeypot:

 

https://solutionfactor.net/blog/2014/02/01/honeypot-technique-fast-easy-spam-prevention/

 

If you read the sanitization function page there are examples on how to do this.

 

For example: $email = $_POST['email']."\r\n";

 

Becomes:

$email = $_POST['email'];
$sanitized_email = filter_var($email, FILTER_SANITIZE_EMAIL);

You then use $sanitized_email in your $message instead of $email

 

However, the $_POST data isn't getting as far as the submission script. So the problem could be in contact.php. There is no way of knowing without having everything

 

It might be better to give someone access the the site so they can do a proper investigation

Just says error at the bottom of the form once you click send message

And it does this if

 

(isset($_POST['email']) && isset($_POST['name']) && isset($_POST['offer']))

 

is false.

 

So you need to look at contact.php and see if is passing the $_POST array to the processing script. I suspect not which is why you get the error message

What happens if you change:

 

<?php
if(isset($_POST['email']) && isset($_POST['name']) && isset($_POST['offer'])){

To:

<?php
if(isset($_POST['email'])) {
    echo 'email is set';
}
if(isset($_POST['name'])) {
    echo 'name is set';
} 
if(isset($_POST['offer'])) {
    echo 'offer is set';
}
exit();

?

Nope, still shows error?

Changing the customer_message.txt file as below...

Edited March 30, 20179 yr by danbingham

<?php

if(isset($_POST['email'])) {

echo 'email is set';

}

if(isset($_POST['name'])) {

echo 'name is set';

}

if(isset($_POST['offer'])) {

echo 'offer is set';

}

exit();

 

$email = $_POST['email']."\r\n";

$name = $_POST['name']."\r\n";

$offer = $_POST['offer']."\r\n";

$message_date = date('d-m-Y H:i');

 

//-- your txt file name

$file = 'customer_message.txt';

Don't know what else you did but it seems to be working now.

It's still not capturing the data. You can now submit the form but nothing happens after that?

But I'm not getting an error message which means it's passing the checks.

 

If you want this fixed you really need to give someone a login to the site to do some diagnostics. At the moment we are all just guessing.

Just out of curiosity is there a reason you chose not to use one of the many free contact forms out there? That has security in mind and have been tested