Thursday, 12 September 2013

Is This Contact Form Email Script Secure

Is This Contact Form Email Script Secure

I found the following contact form script online and I want to find out if
it is secure, and if it is not how I might make it more secure. I just
went back to the page where I think I got the code a long time ago and I
see one commentor said :
"client side validation is only for user conveneicne, it doens't prevent
spam, hackers, or annoying web devs. All a hacker has to do is create
their own HTML file without javascript. Spam bots wouldn't even use the
form they'll just parse it for the id's and send raw packets. Always check
input on the server, never trust the user. "
I'm not exactly sure what that means, but hoping if someone sees a
vulnerability in the code below it the comment may make more sense :
<?php
$EmailFrom = Trim(stripslashes($_POST['Email']));
$EmailTo = "info@mysite.com";
$Subject = "Customer Inquiry from MySite.com";
$Name = Trim(stripslashes($_POST['Name']));
$Tel = Trim(stripslashes($_POST['Tel']));
$Email = Trim(stripslashes($_POST['Email']));
$Message = Trim(stripslashes($_POST['Message']));
// validation
$validationOK=true;
if (!$validationOK) {
print "<meta http-equiv=\"refresh\"
content=\"0;URL=http://www.mysite.com/contact-us-error.php\">";
exit;
}
// prepare email body text
$Body = "";
$Body .= "Name: ";
$Body .= $Name;
$Body .= "\n";
$Body .= "Tel: ";
$Body .= $Tel;
$Body .= "\n";
$Body .= "Email: ";
$Body .= $Email;
$Body .= "\n";
$Body .= "Message: ";
$Body .= $Message;
$Body .= "\n";
// send email
$success = mail($EmailTo, $Subject, $Body, "From: <$EmailFrom>");
// redirect to success page
if ($success){
print "<meta http-equiv=\"refresh\"
content=\"0;URL=http://www.mysite.com/contact-us-success.php\">";
}
else{
print "<meta http-equiv=\"refresh\"
content=\"0;URL=http://www.mysite.com/contact-us-error.php\">";
}
?>
Thanks for taking a look

No comments:

Post a Comment