The problem: I have a very simple PHP contact form on my business’s website. It has worked great for years, but in the last week has been hacked. I now receive hundreds of contact form submissions a day with no comments, they only have (apparently valid) email addresses, and a string of characters in the name field (like “58ee8b52eef46”).
I have tried several techniques to prevent this spam, and they either break my php form, or they don’t prevent the spam. If possible I would like a solution that does NOT require a Captcha distorted text test and does NOT require all fields of the form to be filled.
<?php if(isset($_POST['email'])) { $email_to = "myemail@example.com"; $email_subject = "website form submission"; function died($error) { echo "We are very sorry, but there were error(s) found with the form you submitted. "; echo "These errors appear below.<br /><br />"; echo $error."<br /><br />"; echo "Please go back and fix these errors.<br /><br />"; die(); } if (!isset($_POST['name']) || !isset($_POST['email']) || !isset($_POST['telephone']) || !isset($_POST['comments'])) { died('We are sorry, but there appears to be a problem with the form you submitted.'); } $name = $_POST['name']; $email_from = $_POST['email']; $telephone = $_POST['telephone']; $comments = $_POST['comments']; $error_message = ""; if(strlen($error_message) > 0) { died($error_message); } $email_message = "Form details below.\n\n"; function clean_string($string) { $bad = array("content-type","bcc:","to:","cc:","href"); return str_replace($bad,"",$string); } $email_message .= "Name: ".clean_string($name)."\n"; $email_message .= "Email: ".clean_string($email_from)."\n"; $email_message .= "Telephone: ".clean_string($telephone)."\n"; $email_message .= "Comments: ".clean_string($comments)."\n"; $headers = 'From: '.$email_from."\r\n" . 'Reply-To: '.$email_from."\r\n" . 'X-Mailer: PHP/' . phpversion(); @mail($email_to, $email_subject, $email_message, $headers); ?> Thank you for contacting us. We will be in touch with you soon. You will now be redirected back to example.com. <META http-equiv="refresh" content="2;URL=http://www.example.com"> <?php } die(); ?>
Article Categories:
PHP