Wrox Programmer Forums
Go Back   Wrox Programmer Forums > PHP/MySQL > Beginning PHP
|
Beginning PHP Beginning-level PHP discussions. More advanced coders should post to the Pro PHP forum.
Welcome to the p2p.wrox.com Forums.

You are currently viewing the Beginning PHP section of the Wrox Programmer to Programmer discussions. This is a community of software programmers and website developers including Wrox book authors and readers. New member registration was closed in 2019. New posts were shut off and the site was archived into this static format as of October 1, 2020. If you require technical support for a Wrox book please contact http://hub.wiley.com
 
Old March 9th, 2013, 04:09 PM
Registered User
 
Join Date: Mar 2013
Posts: 2
Thanks: 0
Thanked 0 Times in 0 Posts
Question Contact Form Too Restrictive - Many "Invalid Characters" Errors

I'm using a contact form I found online. I chose this particular form because it allows multiple recipients and incorporates anti-spam measures without using Captcha. Unfortunately, the anti-spam measures are SO restrictive that visitors have difficulty sending a simple message with typical punctuation without incurring errors.

For example, if you enter "can't" instead of "cant" in the message field & hit send, it generates the following error:

"Invalid characters ( # @ ^ ' " \ * = ; % < > ` ~ + ) entered in text area (for example if you wrote the word that's take out the '). Please go back and fix, Then click send!".

My knowledge of PHP is limited. If I could just understand how to edit the appropriate lines, I could then select what restrictions to allow in the message field.

Here is the full code:

Code:
<?php
#This line must remain here. Thankyou. 'Hacker Fighter' PHP contact form V 1.1. Copyright 2011 Joshua Luther Hunt-Smith, all rights reserved. Project page URL: servertosite.com/php-contact-forms-open-source/hacker-fighter.html This project is released under the BSD license: creativecommons.org/licenses/BSD/

function mailio($chk){
if(preg_match('/^[\w.-]+@[\w.-]+\.([\w.]{2,10})\z/',$chk) && strlen($chk) < 70)
{;}else if($chk===''){die('<h1>Email address input left empty. Please go back and put in your email address <span>(!)</span></h1>');}else{die('<h1>Invalid email address entered. Please go back and fix it before sending <span>(!)</span></h1>');}}
function texti($zn){
if(!preg_match('/^([\w-\s]+)\z/',$zn) && strlen($chk) < 70){die('<h1>Invalid characters entered in a text/number field or else text exceeds 70 character limit (Note: The main message text area has a much larger 20000 character limit). Please go back and fix before sending <span>(!)</span></h1>');}}
function txar($xa){
if(!preg_match('/^([\w$&!?.,-\s\:\/]+)\z/',$xa)){die('<h1>Invalid characters ( # @ ^ ' &quot; \ * = ; % &lt; &gt; ` ~ + ) entered in text area (for example if you wrote the word that's take out the '). Please go back and fix, Then click send <span>(!)</span></h1>');}}

$subject= $_SERVER['HTTP_HOST'];
$sbot= $_POST['text'];
$name= $_POST['name'];
$email= $_POST['email'];
$deps= $_POST['whd'];
$msg= $_POST['message'];

//The list of email addresses shown below need to be changed to your receiving email addresses, please only change between the two ' ' in each instance. if you want more or less email addresses, copy or remove the whole line that says case 3 and either paste it below case 3, but rename it as case 4, you can repeat this for as many as you want, or to remove just leave it out the line you removed. Just remember that your corrsponding inputs in the contact interface will need to match and have more options and numerically numbered values added or deleted.
switch($deps){
case 1:$you='[email protected]';break;
case 2:$you='[email protected]';break;
case 3:$you='[email protected]';break;

default:die('<h1>Hacking Attempted or a Processing Error Occured</h1>');}

if($sbot===''){$sbot;}else{die('<h1>You filled in an input, that was supposed to remain blank as an anti spam measure. Go back and fill in only labeled inputs <span>(!)</span></h1>');}
if(strlen($msg) > 20000){die('<h1>20000 character text limit exceeded in message field, please go back and shorten message <span>(!)</span></h1>');}
mailio($email);
if($name===''){die('<h1>You left the name field empty. Please go back and check that all fields are filled out, then send <span>(!)</span></h1>');}else{texti($name);}
if($msg===''){die('<h1>You didn\'t fill in a message. Please go back and check that all fields are filled out, then send <span>(!)</span></h1>');}else{txar($msg);}
$br= nl2br($msg);
$mx=<<<cb
<h4>Name:</h4> $name
<br />
<h4>Email:</h4> $email
<br />
<h4>Message:</h4>
$br
cb;

$hdrs = "From:$email\r\n";
$hdrs .= 'Content-type: text/html; charset=utf-8' . "\r\n";
mail($you,$subject,$mx,$hdrs);
echo '<h1>Thankyou. Your message has been sent</h1>';
?>
 
Old April 9th, 2013, 02:20 PM
Registered User
 
Join Date: Apr 2013
Posts: 4
Thanks: 0
Thanked 0 Times in 0 Posts
Smile

Often times having a contact form on your site is a requirement, but it does open your site to direct or indirect hacking.

A malicious individual could send out spam from your contact form to thousands of people if they are able to craft the information in your contact form just right. ( This happened to a friend of mine. His email suddenly stopped working and his domain was put on email black list servers. )

So having a good level of security is a requirement.

Typically, you would want to use a high-quality library such as something from PEAR see http://pear.php.net/package/Mail

You can also look at this article http://www.phpbuilder.com/columns/ia...n20060412.php3

Hope this helps. Reply back if you need more help.
 
Old July 4th, 2013, 02:28 AM
Registered User
 
Join Date: Jul 2013
Posts: 11
Thanks: 0
Thanked 1 Time in 1 Post
Default

try to edit regx of this function:

Code:
function txar($xa){
if(!preg_match('/^([\w$&!?.,-\s\:\/]+)\z/',$xa)){die('<h1>Invalid characters ( # @ ^ ' &quot; \ * = ; % &lt; &gt; ` ~ + ) entered in text area (for example if you wrote the word that's take out the '). Please go back and fix, Then click send <span>(!)</span></h1>');}}
 
Old October 26th, 2013, 06:59 PM
Registered User
 
Join Date: Mar 2013
Posts: 2
Thanks: 0
Thanked 0 Times in 0 Posts
Default

Follow up...

I never could get this buggy form code to work properly. I ended up using Fast Secure Contact Form which works very well. Thanks to everyone who tried to help :)





Similar Threads
Thread Thread Starter Forum Replies Last Post
ch06 there is no name in "add a contact" jli08 BOOK: Professional XMPP Programming with JavaScript and jQuery 4 April 21st, 2012 01:27 AM
MSXSL gives error message for "for" inside "select" ilyaz XSLT 1 December 9th, 2010 05:02 PM
How to theme the "Browse" button of "FileUpload" control? varunbwj BOOK: Beginning ASP.NET 3.5 : in C# and VB BOOK ISBN: 978-0-470-18759-3 2 October 14th, 2009 01:22 AM
Add a CheckBox DataColumn to my DataGridView, Null format: "" or "True" but Error: F ismailc C# 2005 0 September 25th, 2009 04:56 AM
Chapter-5 on Intents:ContactPickerTester does not show the button "Pick a Contact" sunilm12 BOOK: Professional Android Application Development ISBN: 978-0-470-34471-2 3 April 15th, 2009 11:55 AM





Powered by vBulletin®
Copyright ©2000 - 2020, Jelsoft Enterprises Ltd.
Copyright (c) 2020 John Wiley & Sons, Inc.