Spam Protection to Contact Form

Server Config
1

I have a decent looking and working contact form on the go, however it doesn’t have any validation / protection from spam.

How can I implement some sort of security measure to this script and form? May it be Math Calculation for validation or something as simple?

Many Thanks.

<?php

if(!$_POST) exit;

$email = $_POST['email'];

//$error[] = preg_match('/\\b[A-Z0-9._%-]+@[A-Z0-9.-]+\\.[A-Z]{2,4}\\b/i', $_POST['email']) ? '' : 'INVALID EMAIL ADDRESS';
if(!eregi("^[a-z0-9]+([_\\\\.-][a-z0-9]+)*" ."@"."([a-z0-9]+([\\.-][a-z0-9]+)*)+"."\\\\.[a-z]{2,}"."$",$email )){
$error.="Invalid email address entered";
$errors=1;
}
if($errors==1) echo $error;
else{

$values = array ('name','email','phone','message');
$required = array('name','email','message');

$email_to = "contact@emeraldcontract.com";
$email_subject = "new message";
$email_content = "new message:\
";

//for( $i = 0 ; $i < count( $values ) ; ++$i ) {
//    for( $c = 0 ; $c < count( $required ) ; ++$c ) {
//        if( $values[$i]==$required[$c] ) {
//            echo $required[$x];
//            if( empty($_POST[$values[$i]]) ) { echo 'PLEASE FILL IN REQUIRED FIELDS'; exit; }
//        }
//    }
//    $email_content .= $values[$i].': '.$_POST[$values[$i]]."\
";
//}

foreach($values as $value){
  if(in_array($value,$required)){
    if( empty($_POST[$value]) ) { echo 'PLEASE FILL IN REQUIRED FIELDS'; exit; }
    $email_content .= $value.': '.$_POST[$value]."\
";
  }
}

if(mail($email_to,$email_subject,$email_content)) {
    echo 'Message sent!';
} else {
    echo 'ERROR!';
}
}
?>

PS: I’m using label / input method for form on contact page.

<form action="contactscript.php" method="post" id="contactform">
	<ol><li>
		<label for="name">What is your name?<br /></label>
		<input id="name" name="name" class="text" />
	</li> etc.....................
2

The usual approach is to add a Captcha to the form. I know it’s not very popular with some visitors, but it does work, and most people are used to it now. If you do a search, you’ll find plenty of examples.

One thing I personally hate is ReCaptcha. That’s where there are two strings that you have to type, and one of them is much harder to read (by humans) than the other. I frequently fail to type the hard one, and I suspect many other people do too.

One other piece of advice: Create a new email address to receive the form submission, and don’t use it for anything else. That way, if the worst happens and the address becomes compromised, you can always change it at a moment’s notice.

Hope this helps.

Mike

3

Fellow Scott. :slight_smile: - Thanks for the reply.

I absolutely hate ReCaptcha myself, my sight ain’t even average as it is, so it’s incredibly hard.

Noted.

[QUOTE=Mikl,post:2,topic:11811"]
The usual approach is to add a Captcha to the form. I know it’s not very popular with some visitors, but it does work, and most people are used to it now. If you do a search, you’ll find plenty of examples.
[/quote]

I’ve aware of Captcha but i’ve no idea of its implementation into my current script.

http://www.html-form-guide.com/contact-form/html-contact-form-captcha.html

How exactly can the following from the above link be altered to fit my current script in OP?


if(isset($_POST['submit']))
{
  if(empty($_SESSION['6_letters_code'] ) ||
    strcasecmp($_SESSION['6_letters_code'], $_POST['6_letters_code']) != 0)
  {
      //Note: the captcha code is compared case insensitively.
      //if you want case sensitive match, update the check above to
      // strcmp()
    $errors .= "\
 The captcha code does not match!";
  }
  if(empty($errors))
  {
    //send the email
    $to = $your_email;
    $subject="New form submission";
    $from = $your_email;
    $ip = isset($_SERVER['REMOTE_ADDR']) ? $_SERVER['REMOTE_ADDR'] : '';
    $body = "A user  $name submitted the contact form:\
".
    "Name: $name\
".
    "Email: $visitor_email \
".
    "Message: \
 ".
    "$user_message\
".
    "IP: $ip\
";
    $headers = "From: $from \\r\
";
    $headers .= "Reply-To: $visitor_email \\r\
";
    mail($to, $subject, $body,$headers);
    header('Location: thank-you.html');
  }
}
4

As far as I can see, the PHP code looks fine as it stands.

What you appear to be missing is a way of displaying the Captcha in your form. The sample HTML code in the page that you referenced shows you how to do that. But you will also need a server-side function to actually create the Captcha image - that’s the function they call captcha_code_file, which is in a file in the zip file that you download. Have you tried using that yet?

To summarise, it looks like they have provided everything you need. But, to be fair, I’m not familiar with this particular code, so I can’t be sure.

Mike

5

Yes, my contact script is working fine and I just want to add some sort of security to it. May it even be a simple question.

I added this to my script…

if(empty($_SESSION['6_letters_code'] ) ||
	  strcasecmp($_SESSION['6_letters_code'], $_POST['6_letters_code']) != 0)
	{
	// strcmp
		$errorss .= "The captcha code does not match!";
	}
	if(empty($errorss))
	{

I added this to my form…

	<p>
<img src="captcha_code_file.php?rand=<?php echo rand(); ?>" id='captchaimg' ><br>
<label for='message'>Enter the code above here :</label><br>
<input id="6_letters_code" name="6_letters_code" type="text"><br>
<small>Can't read the image? click <a href='javascript: refreshCaptcha();'>here</a> to refresh</small>
</p>

Added this too my head…

<script language='JavaScript' type='text/javascript'>
function refreshCaptcha()
{
	var img = document.images['captchaimg'];
	img.src = img.src.substring(0,img.src.lastIndexOf("?"))+"?rand="+Math.random()*1000;
}
</script>

Ohhh yes and the captcha_code_file that you said aswell… But it didn’t work. The captcha didn’t even work and I just got Parse error: syntax error…

6

Question…

How does this look?.. Needs fixed a little somehow, somewhere.

$mentalQuestion == TRUE)
	{
		foreach($mentalQuestionList as $question) {if($question[0] == $_POST['question']){$answer = $question[1];}}
		if($answer != $_POST['finalAnswer'] || $answer == NULL)
		{
			$message = 'Your answer to "'.$_POST['question'].'" is invalid.';
		}


<textarea name="messageText" cols="40" rows="4" id="messageText"><?php echo $_POST['messageText'];?></textarea>
<?php
	if($mentalQuestion == TRUE)
	{
		$random = rand(0,count($mentalQuestionList)-1);
		$question = $mentalQuestionList[$random][0];
?>
<?php echo $question;?>
<input name="finalAnswer" type="text" id="finalAnswer" value="<?php echo $_POST['finalAnswer'];?>" />
7

Sorry, but I can’t immediately see anything wrong with what you’ve got. You say you want to add security, but isn’t that why you have the Captcha in the first place?

Regarding your point that the captcha_code_file not working: I can’t suggest a solution without actually running it myself. I’ll maybe do that if I can grab some time. But perhaps someone with more experience of this will chip in.

Mike

8

I don’t have Captcha on my form. I was only suggesting the mental question above as an alternative choice to captcha.

Nae worries though!

9

You got that right. It’s usually so hard to read I have to click for a new image, often multiple new images until I get one I can decipher.

I’ve used the Securimage free PHP Captcha and it works really well. It’s very easy to implement.

http://www.phpcaptcha.org/