2
\$\begingroup\$

I am currently working on a PHP-Formmailer. I`m completely new to PHP but I do have knowledge about HTML, CSS and Javascript. I would learn PHP starting with the basics and everything but I´ll be leaving the day after tomorrow so I would be very happy to see a quick solution :)

Mainly I´m concerned that the formmailer may be abused or that the e-mail will get spammed. Here´s what I did in HTML to prevent that:

  • Give the input-element a special type(like number or email)
  • Give the needed input-elements the value "required"
  • Make sure that search engines don´t find the website containing the form by adding

    <meta name="robots" content="noindex" /> 
    

to the header.

Now here is my PHP:

<?php


// ======= config:

$mailTo = 'myEmail';
$mailFrom = 'formmailer@homepage.com';
$mailSubject    = 'Formmailer of the homepage';
$returnPage = 'returnPage';
$returnErrorPage = 'errorPage';
$mailText = "";
// ======= configEND====

if(isset($_POST)) { 
   foreach($_POST as $name => $value) {
         $mailText .= $name . ": " . htmlspecialchars($value) . "\n";
   }
}

 if(get_magic_quotes_gpc()) {
     $mailtext = stripslashes($mailtext);
 }

$mailSent = @mail($mailTo, $mailSubject, $mailText, "From: ".$mailFrom);

if($mailSent == TRUE) {  header("Location: " . $returnPage);}
else { header("Location: " . $returnErrorPage);}

exit();

?>

Do you think that this is safe enough for a small homepage? Am I using htmlspecialchars() correctly? Should I better use strip_tags()?

\$\endgroup\$
2
\$\begingroup\$

Your $mailTo, $mailSubject, and $mailFrom are all hard-coded values, which is good for security, because the mail headers are out of the client's control. (Otherwise, you would have to watch out for a header-splitting attack.)

If anything, you're overcompensating. htmlspecialchars() should play no role in the composition of plain-text e-mail. All it does is mangle the message body so that characters like & end up looking like &amp;. Not catastrophic, but incorrect and annoying.

The HTTP protocol is designed with the convention that GET and HEAD requests are free of side-effects, but POST requests may initiate actions. Therefore, you want to only send an e-mail if you received a POST request. However, your script is written such that a GET or HEAD request would send you an e-mail with an empty body. In a sense, you are committing a less-serious version of the Spider of Doom error. (Summary: someone's website CMS was written such that a GET request could instruct the webserver to delete a page. Hilarity ensues when Googlebot starts crawling their site.) You should not rely on robots respecting <meta name="robots" content="noindex" /> to avoid that situation.

\$\endgroup\$
  • \$\begingroup\$ Thank you for your answer. I thought that I would have to use htmlspecialchars() since the user has the ability to send a code to the server without it. Couldn´t he just enter some code and the server would execute it? Or summarized: Do I only have to pay attetion that it is impossible to bring malicious content into the mail-header (as you mentioned)? Or do I also have to "protect" the server? Could I fix the issue you are talking in the last paragraph by wrapping the code with "if ($_SERVER['REQUEST_METHOD'] === 'POST') {//my code}" \$\endgroup\$ – user64494 Feb 5 '15 at 13:42
  • \$\begingroup\$ No, your server will be fine. The worst that an attacker can do is to flood you (and only you) with junk, assuming that you don't have any rate-limiting mechanism in your webserver. Your server would not execute any data submitted by the client. \$\endgroup\$ – 200_success Feb 5 '15 at 13:48
  • \$\begingroup\$ Yes, you should be putting nearly your entire script inside an if block that checks REQUEST_METHOD. \$\endgroup\$ – 200_success Feb 5 '15 at 13:49

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy