How to check for, and kill, a link upon submit

[espmartin]

Hello All,

I have this PHP script that checks for empty form fields, but I don't know how
to incorporate a check in the "msg" field for a URL. I've been getting tons of
link spam in these forms, and so upon submission, I'd like to echo a msg to the
user that their post will be dead upon arrival. My failed attempt is commented out below.

Can you GREAT people "fill in" this script snip with the actual PHP code that will
work?

<?php # now to check for valid input...
    $ipi = $_REQUEST['ip'];
    $firstname = $_REQUEST['first-name'];
    $lastname = $_REQUEST['last-name'];
    $emailaddress = $_REQUEST['email-address'];
    $urllist = $_REQUEST['urls'];
    $msg = $_REQUEST['msg'];

        /* begin what I've tried... */
    
    if ($msg == "http:") {
        alert("You Crazy spammer! Your message will be rejected, and your IP will be denied.");
        }
        /* end what I've tried... */

    if (!isset($_REQUEST['ip']) || !isset($_REQUEST['first-name']) || !isset($_REQUEST['last-name']) || !isset($_REQUEST['email-address']) || !isset($_REQUEST['urls']) || !isset($_REQUEST['msg'])){
      header( "Location: http://my-domain.com/page.html#form-container" );
    }
    elseif (empty($ipi) || empty($firstname) || empty($lastname) || empty($emailaddress) || empty($urllist) || empty($msg)) {
      header( "Location: http://my-domain.com/sub-folder/contact-error.php" );
    }
    else {
        $ToAddress = "seo-contact-form@my domain dot com";
        $message  = "Martin, you have a message from the AWD SEO Contact form\n";
        $message .= "--------------------------------------------\n";
        foreach ($_POST as $key => $value){$message .= "$key: $value\n";}
        $message .= "--------------------------------------------\n";
        mail("<$ToAddress>","Message from the AWD SEO Contact form", $message,"From: $ToAddress");
    }
?>

[markbrown4]

Hi,

If you just want to check if msg contains the string 'http://' then you can use
if (strrpos("http://", $msg)) { // You're a phony! }

http://au2.php.net/strrpos

Hope it helps

[espmartin]

What am I doing wrong? It does nothing. I've added it as a last elseif below:

    if (!isset($_REQUEST['ip']) || !isset($_REQUEST['first-name']) || !isset($_REQUEST['last-name']) || !isset($_REQUEST['email-address']) || !isset($_REQUEST['urls']) || !isset($_REQUEST['msg'])){
      header( "Location: http://my-domain.com/index.php#form-container" );
    }
    elseif (empty($ipi) || empty($firstname) || empty($lastname) || empty($emailaddress) || empty($urllist) || empty($msg)) {
      header( "Location: http://my-domain.com/includes/contact-error.php" );
    }
    elseif (strrpos("http://", $msg)) { 
      header( "Location: http://somehere-else-you-phony.com" );
     } 

[markbrown4]

$msg needs to have a value..

$msg = $_GET['msg'];

[praetor]

// Use strpos() here instead of 
if ($msg == "http:")  { }

[espmartin]

Thanks all so far!

When I tweak the code to look like this, it half works:

    elseif (strrpos("http://", $msg = $_GET['msg'])) { 
      header( "Location: http://mydomain.com/contact-error.php" ); 

If I fill out the form for testing, and ad a URL to the msg field, I do get the desired
logic. But when I DON'T ad a url (http://xxx...) I STILL get that error page...

Any thoughts?

[markbrown4]

elseif (strrpos("http://", $_GET['msg'])) { 
      header( "Location: http://mydomain.com/contact-error.php" ); 
}

OR

$msg = $_GET['msg']; // Somewhere at top of page
...
elseif (strrpos("http://", $msg)) { 
      header( "Location: http://mydomain.com/contact-error.php" ); 
}

[espmartin]

I do have this at the top of the page:

    $msg = $_REQUEST['msg']; 

And this to check for an empty field

elseif (empty($ipi) || empty($firstname) || empty($lastname) || empty($emailaddress) || empty($urllist) || empty($msg)) { 

It's that last one...

So how does that change things?

[markbrown4]

If you set:

$msg = $_REQUEST['msg']

at the top of the page then you don't need to use $_REQUEST to get that variable again. You have a copy in the variable $msg;

So you should be able to just use

elseif (strrpos("http://", $msg) != false) { 
      header( "Location: http://mydomain.com/contact-error.php" ); 
}