Hi,
will you please go over this mailer code, and see if it’s ok, and secure.
I tested it, and instead of receiving the mail with the data on the form I got the message that was intended for the submitter.
I used one email to receive the mail, and used another email as the sender of the form, but both got the messahe intended for the sender.
I know I have to hide the honeypot address field, I left it visible for testing.
Thank you
The html form
<!DOCTYPE html>
<html lang="en">
<head>
<meta charset="utf-8">
</head>
<body>
<div class="row">
<div class="col-md-9">
<div class="well well-sm">
<form method="POST" action="mailer.php" onsubmit="return validate_2()">
<div class="row">
<div class="col-md-6">
<div class="form-group">
<label for="name">Name</label>
<input type="text" class="form-control" id="name" name="name" maxlength="19" placeholder="Nome" required="required" />
</div>
<div class="form-group">
<label for="lastname">Last Name</label>
<input type="text" class="form-control" id="lastname" name="lastname" maxlength="27" placeholder="Last Name" required="required" />
</div>
<div class="form-group">
<label for="address">Address</label>
<input type="text" class="form-control" id="address" name="address" maxlength="27" placeholder="address" />
</div>
<div class="form-group">
<label for="email">Email</label>
<div class="input-group">
<span class="input-group-addon"><span class="glyphicon glyphicon-envelope"></span>
</span>
<input type="email" class="form-control" id="email" name="email" maxlength="54" placeholder="Email" required="required" />
</div>
</div>
<div class="form-group">
<label for="phone">Phone</label>
<input type="text" class="form-control" id="phone" name="phone" maxlength="19" placeholder="Phone - land or mobile" required="required" />
</div>
</div>
<div class="col-md-6">
<div class="form-group">
<label for="message">Message</label>
<textarea id="message" name="message" class="form-control" rows="6" cols="25" required="required" placeholder="Message"></textarea>
</div>
<div class="form-group">
<label for="solutioncon">Please write the total of 9+7+3</label>
<input type="text" class="form-control" id="solutioncon" name="solutioncon" maxlength="2" placeholder="type solution" required="required" />
</div>
</div>
<div class="col-md-12">
<button type="submit" class="btn btn-primary pull-right" id="btnContactUs">Send Message</button>
</div>
</div>
</form>
</div>
</div>
</div>
</body>
</html>
The mailer.php file
<?php
//MAIL HEADER INFORMATION
$EmailFrom = "site.com";
$EmailTo = "info@site.com";
$Subject = "message from site";
// NOW TEST FOR FIELDS THAT ARE REQUIRED
$required = array(); // ADD YOUR FIELDS AS NEEDED
$all_okay = TRUE;
foreach ($required as $key) {
if ($clean_post["$key"] == '') {
echo "<br/>$key is a required field\n";
$all_okay = FALSE;
}
}
// TEST FOR MISSING INPUT
if (!$all_okay) {
$referer = $_SERVER['HTTP_REFERER'];
echo "<br /><strong><a href=\"$referer\">Please click to go back, and fill the required fields!</a></strong>\n";
die();
}
// PREPARE THE DATA
$name = Trim(stripslashes($_POST['name']));
$lastname = Trim(stripslashes($_POST['lastname']));
$address = Trim(stripslashes($_POST['address']));//honeypot checking
$email = Trim(stripslashes($_POST['email']));
$phone = Trim(stripslashes($_POST['phone']));
$message = Trim(stripslashes($_POST['message']));
$solutioncon = Trim(stripslashes($_POST['solutioncon']));
// PREPARE EMAIL BODY TEXT
$body = '';
$body .= "Dear " . $name . " " . $lastname . " this is copy of your message. \n
We will reply asap." . "\n \n"; // THIS IS TO HAVE PERSONALIZED MESSAGE
foreach ($clean_post as $key => $value) {
$body .= $key . ': ' . $value . "\r\n";//aggiunto \r
}
$submitter = $_POST["email"];
$site = "no-reply@site.com";
/////////
if($address)
$error = "Your message could not be sent. It has been flagged as spam. If error, please <a href='javascript:history.back(1)'>go back and try again</a>.";
else {
// send email
$success = mail($EmailTo, $Subject, $body, "From: <$EmailFrom>");
mail($submitter, $Subject, $body, "From: <$site>");
}
// redirect to success page
if ($success){
header( "Location: http://site.com/thankyou_con.php" );
}
else
{print "There has been a technical problem, please resend, thank you."; }
?>
