/    Sign up×
Community /Pin to ProfileBookmark

[RESOLVED] need PHP verification

I attempted to code a contact form for a website and this is what I came up with. I believe it works fine sending an email to the website owner, but I’m not sure if the email sent to the person using the form is coded correctly.

The address for the form is [URL=”http://www.streetartimpressions.com/contact.html”]http://www.streetartimpressions.com/contact.html[/URL]. This is my PHP code:

[code=php]<?php

//This section checks to make sure all required information was filled out.
if(empty($_POST[‘name’]) || empty($_POST[’email’]) || empty($_POST[‘phone’]) || empty($_POST[‘address1’]) || empty($_POST[‘address2’]) || empty($_POST[‘address3’]) || empty($_POST[‘comment’])) {
echo(‘Please go <a href=”javascript:history.go(-1)”>back</a> and complete all requested information.’);

//If all information was filled out, the script continues here.
} else {

//This section composes the body of the email that will be sent.
$today = date (“l, F jS Y H:i:s”);
$emailBody .= “nDate: $today n”;
$emailBody .= “———— nn”;
$emailBody .= “Name: “.$_POST[‘name’].” n”;
$emailBody .= “Email Address: “.$_POST[’email’].” n”;
$emailBody .= “Phone Number: “.$_POST[‘phone’].” n”;
$emailBody .= “Best time to call: “.$_POST[‘time’].” n”;
$emailBody .= ” n”;
$emailBody .= “Address:n”;
$emailBody .= $_POST[‘address1’].”n”;
$emailBody .= $_POST[‘address2’].”n”;
$emailBody .= $_POST[‘address3’].”n”;
$emailBody .= ” n”;
$emailBody .= “Comments:n”;
$emailBody .= $_POST[‘comment’].”n”;
$emailBody .= ” n”;

//This part of the code mails the form to the Street Art Impressions.
mail(“[email protected]”,”Contact from StreetArtImpressions.com”,$emailBody);

//This part of the code mails the form to the person contacting Street Art Impressions.
mail($email,”Thank you for contacting us”, “Thank you for contacting Street Art Impressions. If a reply is necessary, we will contact you at “.$_POST[’email’].” as soon as possible. Here’s a copy of the information you sent us:nn” .$emailBody);

//This will be displayed for the user after clicking submit.
echo(‘Thank you for taking the time to contact us. Please <a href=”http://www.streetartimpressions.com”>click here</a> to return to the main site.’);

}

?>[/code]

Can someone please verify for me if the [COLOR=”Blue”]$email[/COLOR] in the second mail is correct. I wasn’t sure if it needed to be [COLOR=”Green”].[/COLOR][COLOR=”Blue”]$email[/COLOR], [COLOR=”Blue”]$email[/COLOR], or [COLOR=”Green”].[/COLOR][COLOR=”Blue”]$_POST[/COLOR][COLOR=”Green”][[/COLOR][COLOR=”Red”]’email’[/COLOR][COLOR=”Green”]][/COLOR][COLOR=”Green”].[/COLOR] For all I know, it could be something else entirely.

Thanks for the help in advance.

to post a comment
PHP

7 Comments(s)

Copy linkTweet thisAlerts:
@JickMay 03.2008 — It would need to be [FONT="Courier New"]$_POST['email'][/FONT] in this case. However, I wouldn't recommend you do it like that. You should have some code to validate the E-mail address before you use it in your script. Because if you use the E-mail address directly from the input without checking it at all first that will open your script to vulnerabilities. There are tons of pre-made functions around the web for checking E-mail addresses. Just do a quick search on Google. Then you can just throw that in your script and rest easy that your script isn't in trouble. ?
Copy linkTweet thisAlerts:
@Wiz_CreationsauthorMay 04.2008 — I found two email validations, but I don't know which one is better. If I'm not mistaken, I should put this after the check that all inputs were filled out and before the emailBody scripts. I think that the emailBody and mail scripts would go where it says "Email address is valid" on the first script and where it says "return true" on the second PHP script, but I'm not sure. Could someone please post a modified version of my original post with one of these PHP validators included? Thank you very much!
[code=php]function checkEmail($email) {
// checks proper syntax
if(preg_match("/^( [a-zA-Z0-9] )+( [a-zA-Z0-9._-] )*@( [a-zA-Z0-9_-] )+( [a-zA-Z0-9._-] +)+$/" , $email)) {
// gets domain name
list($username,$domain)=split('@',$email);
// checks for if MX records in the DNS
if(!checkdnsrr($domain, 'MX')) {
return false;
}
// attempts a socket connection to mail server
if(!fsockopen($domain,25,$errno,$errstr,30)) {
return false;
}
return true;
}
return false;
}

$email = trim($_POST['email']);
if(!checkEmail($email)) {
echo 'Invalid email address!';
}
else {
echo 'Email address is valid';
}[/code]

[code=php]if (eregi("^[a-z0-9]+([.%!][_a-z0-9-]+)*@[a-z0-9-]+(.[a-z0-9-]+)*$",
$email))
{
list($user, $host) = explode("@", $email);
if ( !checkdnsrr($host, "MX") )
return TRUE;
}
else
{
return FALSE;
}
}[/code]
Copy linkTweet thisAlerts:
@NogDogMay 04.2008 — The best email address format validation I know of:
[code=php]
# email address validation function
# kudos to http://iamcal.com/publish/articles/php/parsing_email/
function is_valid_email_address($email) {
$qtext = '[^\x0d\x22\x5c\xa6-\xff]';
$dtext = '[^\x0d\x5b-\x5d\xa6-\xff]';
$atom = '[^\x00-\x20\x22\x28\x29\x2c\x2e\x3a-\x3c'.
'\x3e\x40\x5b-\x5d\xa6-\xff]+';
$quoted_pair = '\x5c[\x00-\xa5]';
$domain_literal = "\x5b($dtext|$quoted_pair)*\x5d";
$quoted_string = "\x22($qtext|$quoted_pair)*\x22";
$domain_ref = $atom;
$sub_domain = "($domain_ref|$domain_literal)";
$word = "($atom|$quoted_string)";
$domain = "$sub_domain(\x2e$sub_domain)*";
$local_part = "$word(\x2e$word)*";
$addr_spec = "$local_part\x40$domain";
return (preg_match("!^$addr_spec$!", $email));
}
[/code]
Copy linkTweet thisAlerts:
@Wiz_CreationsauthorMay 04.2008 — I have no idea how to incorporate any of these into my original PHP.
Copy linkTweet thisAlerts:
@NogDogMay 04.2008 — If you want to use the validation I provided above, just copy-and-paste the code somewhere in your script (or an included file), then call it as part of your validation routine:
[code=php]
if(is_valid_email_address($_POST['email']) == false)
{
// output some sort of error and do not send mail
}
else
{
// it's ok to continue whatever you want to do next
}
[/code]
Copy linkTweet thisAlerts:
@Wiz_CreationsauthorMay 04.2008 — Okay, just to make sure I got this done correctly. Does this look good?
[code=php]<?php

// This function is used to check if a valid email address was entered.
# email address validation function
# kudos to http://iamcal.com/publish/articles/php/parsing_email/
function is_valid_email_address($email) {
$qtext = '[^\x0d\x22\x5c\xa6-\xff]';
$dtext = '[^\x0d\x5b-\x5d\xa6-\xff]';
$atom = '[^\x00-\x20\x22\x28\x29\x2c\x2e\x3a-\x3c'.
'\x3e\x40\x5b-\x5d\xa6-\xff]+';
$quoted_pair = '\x5c[\x00-\xa5]';
$domain_literal = "\x5b($dtext|$quoted_pair)*\x5d";
$quoted_string = "\x22($qtext|$quoted_pair)*\x22";
$domain_ref = $atom;
$sub_domain = "($domain_ref|$domain_literal)";
$word = "($atom|$quoted_string)";
$domain = "$sub_domain(\x2e$sub_domain)*";
$local_part = "$word(\x2e$word)*";
$addr_spec = "$local_part\x40$domain";
return (preg_match("!^$addr_spec$!", $email));
}

//This section checks to make sure all required information was filled out.
if(empty($_POST['name']) || empty($_POST['email']) || empty($_POST['phone']) || empty($_POST['address1']) || empty($_POST['address2']) || empty($_POST['address3']) || empty($_POST['comment'])) {
echo('Please go <a href="javascript:history.go(-1)">back</a> and complete all requested information.');

elseif(is_valid_email_address($_POST['email']) == false) {
echo('The email address you entered was not valid. Please go <a href="javascript:history.go(-1)">back</a> and enter a valid email address. If the address you entered is valid, please send an email directly to <a href="mailto:[email protected]">[email protected]</a> instead of using this form.')
}

//If all information was filled out, the script continues here.
else {

//This section composes the body of the email that will be sent.
$today = date ("l, F jS Y H:i:s");
$emailBody .= "nDate: $today n";
$emailBody .= "------------ nn";
$emailBody .= "Name: ".$_POST['name']." n";
$emailBody .= "Email Address: ".$_POST['email']." n";
$emailBody .= "Phone Number: ".$_POST['phone']." n";
$emailBody .= "Best time to call: ".$_POST['time']." n";
$emailBody .= " n";
$emailBody .= "Address:n";
$emailBody .= $_POST['address1']."n";
$emailBody .= $_POST['address2']."n";
$emailBody .= $_POST['address3']."n";
$emailBody .= " n";
$emailBody .= "Comments:n";
$emailBody .= $_POST['comment']."n";
$emailBody .= " n";

//This part of the code mails the form to the Street Art Impressions.
mail("[email protected]","Contact from StreetArtImpressions.com",$emailBody);

//This part of the code mails the form to the person contacting Street Art Impressions.
mail($_POST['email'],"Thank you for contacting us", "Thank you for contacting Street Art Impressions. If a reply is necessary, we will contact you at ".$_POST['email']." as soon as possible. Here's a copy of the information you sent us:nn" .$emailBody);

//This will be displayed for the user after clicking submit.
echo('Thank you for taking the time to contact us. Please <a href="http://www.streetartimpressions.com">click here</a> to return to the main site.');


}

?>[/code]

Thank you for the help.
Copy linkTweet thisAlerts:
@NogDogMay 04.2008 — Looks good to me after a quick scan, but of course the acid test is trying it with various intentional errors to make sure all error-trapping works, then trying it with valid data and making sure the email gets sent.
×

Success!

Help @Wiz_Creations spread the word by sharing this article on Twitter...

Tweet This
Sign in
Forgot password?
Sign in with TwitchSign in with GithubCreate Account
about: ({
version: 0.1.9 BETA 5.5,
whats_new: community page,
up_next: more Davinci•003 tasks,
coming_soon: events calendar,
social: @webDeveloperHQ
});

legal: ({
terms: of use,
privacy: policy
});
changelog: (
version: 0.1.9,
notes: added community page

version: 0.1.8,
notes: added Davinci•003

version: 0.1.7,
notes: upvote answers to bounties

version: 0.1.6,
notes: article editor refresh
)...
recent_tips: (
tipper: @Yussuf4331,
tipped: article
amount: 1000 SATS,

tipper: @darkwebsites540,
tipped: article
amount: 10 SATS,

tipper: @Samric24,
tipped: article
amount: 1000 SATS,
)...