I’m new to PHP and coding in general so I may have just made a really dumb mistake. Pardon if so!
Every evening around 1:48 a.m. the form on my website is being submitted with all values “1”, which is not even possible for some of the values. Is it possible it’s the host company I use, FatCow, doing a test? Here’s the code I used to handle the form and any help really really appreciated.
<?php
$myemail = ‘eric@hidentext.com, tim@hiddentext.com’; //<-----Put Your email address here.
$headers = "From: $myemail";
$headers .= "Reply-To: $email_address";
mail($to,$email_subject,$email_body,$headers);
//redirect to the 'thank you' page
header('Location: contact-form-thank-you.html');
?>
<!DOCTYPE HTML PUBLIC “-//W3C//DTD HTML 4.01 Transitional//EN” “http://www.w3.org/TR/html4/loose.dtd”>
<html>
<head>
<title>Contact form handler</title>
</head>
<body>
<!-- This page is displayed only if there is some error –>
<?php
echo nl2br($errors);
?>
a) detects html inputs on your page
b) ignores your gui
c) submits a 1 in every input form element
This should be a very useful clarion call to you, people trying to break into your site will likely start off using automated bots to find out where your weaknesses are.
Your primary job is to a) be aware of this to protect yourself and your clients and b) thwart them.
Take the email address, that should conform to a particular pattern, and there are PHP tools to help you identify them check data filtering. Finding something like a 1 in that field should cause your script to abort, or return back the GUI with a message.
Take a good look in your server logfiles for that particular moment, tell us what you find if you cannot work it out.
Remove anything which might identify your own server though, and as zalacius says, you have left yourself wide open for malicious attacks, unless you really upset someone in school and they really sit down every night at the same time enter 1,1,1,1,1 in all your form elements.