ansaurus

Question

Hidden fields are not processed with php.

Answer 1

+4 A:

You're circumventing the normal submission process of the form and submitting it through AJAX:

data: 'yourname=' + yourname + '&youremail=' + youremail + '&friendsname=' + friendsname + '&friendsemail=' + friendsemail + '&message=' + message,

This does not include logo, webaddress or adminaddress, so of course they do not arrive at the PHP script.

Also you are not correctly escaping those values, so if someone includes a ‘&’ or other special characters in one of those fields, it'll break. Use encodeURIComponent, or, since you are using jQuery's ajax function, just pass a lookup in and let jQuery take care of that for you:

data: {'yourname': yourname, ...

There are more escaping problems like this.

$headers = "From: " . strip_tags($from) . "\r\n";

Strip_tags is not useful here. Mail headers are plain text; HTML tags have no special meaning. What is dangerous, however, is newlines. This would allow an attacker to add any header they like to the mail, or even possibly send multiple, completely-controlled-by-attacker mails.

You should strongly sanitise anything you are going to put in a mail header; non-ASCII and control characters in particular must be stripped.

  <td valign='top' width='170' style='padding-right:10px'><img src='"
  . $webaddress . $logo . "' />

HTML injection. $webaddress and $logo can contain quotes, allowing an attacker to insert arbitrary HTML and JavaScript code. You need htmlspecialchars($s, ENT_QUOTES) every time you put text into HTML.

It is also dangerous to allow the user to choose any webaddress, logo, adminaddress, etc. This is a gift to spammers: they will submit their own data and message, hijacking your webform to “tell a friend” about their own penis pills instead, and getting your server widely blocked. If you must have a ‘tell a friend’ feature you need to really lock down what the parameters are allowed to be; just putting them in a hidden field is no protection.

bobince 2009-09-26 12:57:49

great answers if people can up the score!

RageZ 2009-09-26 13:13:29

Thanks a lot. I'm afraid I don't know how to pass hidden fields via ajax.

Ovi 2009-09-26 13:14:11

Same way as your other fields, give them an id, slect it and read the `val()`. Or, tvanfosson suggested using `serialize` to get the data for all the form at once, which sounds like a good idea (but his comment's vanished, so maybe there was a reason it wasn't a good idea after all!) http://docs.jquery.com/Ajax/serialize

bobince 2009-09-26 13:23:27

I've sorted out the problems with the hidden fields. I'm not using them any longer but instead I allow the web admin to add the website address and the link to the logo straight into the mail.php file from the CMS.However, could you please give me a few links to resources on how to sanitize the mail headers? I am very new to web programming so I would appreciate anything that is simple to understand. Thank you a lot for all your help.

Ovi 2009-09-26 15:34:30

You could try replacing `[^ -~]` (that is, all characters outside of printable ASCII) with blank strings. Specifically for e-mail addresses, there's also `filter_var` with the setting FILTER_SANITIZE_EMAIL, which can be applied as well.

bobince 2009-09-26 16:38:05

Answer 2

+1 A:

Your PHP script accesses $_POST['adminemail'], but the hidden field is called adminaddress

mabwi 2009-09-26 13:01:15

ansaurus

tags:

views:

answers:

Hidden fields are not processed with php.

related questions