"ghost" form submissions

Question

I have a 3-part registration form using PHP:

page 1 : collects info - has client & server side validation (for blank and invalid fields)
page 2 : collect more info - has server side validation (for blank and invalid fields)
page 3 : saves (db) and sends (email) the registration information

More info:

page 1 : saves all form information into session[registration] before going to page 2
page 2 : redirects to page 1 if session[registration][email] is blank
page 3 : redirects to page 1 if session[registration][email] is blank; destroys session after registration is successful

This has been working fine for the past months until yesterday when around 25 emails were sent to me, with few seconds interval for each. I also checked the database and those registrations were saved. And the registration information are all BLANK (except the auto generated fields like date_added)

I'm puzzled because the email sending and db saving are not supposed to work because of the redirection.

Do you have any idea as to what just happened?

Thanks

Answer 1

How are you checking that the data fields aren't blank before inserting them into the db. Make sure to use empty() to check that the field is blank. If you're using string comparison operator (ie. if ($str != "") ), it can cause unexpected results if the value of $str is false, null, 0, etc...

Edit: empty() description from manual: http://us.php.net/manual/en/function.empty.php Return Values

Returns FALSE if var has a non-empty and non-zero value.

The following things are considered to be empty:

* "" (an empty string)
* 0 (0 as an integer)
* "0" (0 as a string)
* NULL
* FALSE
* array() (an empty array)
* var $var; (a variable declared, but without a value in a class)

edit2:

isset() only checks if a variable was assigned a value. If the variable contains an empty string, isset() will return true, because even an empty string has a value ('\0' marks the end of a string in php).

isset() description from manual : http://us3.php.net/manual/en/function.isset.php

isset() will return FALSE if testing a variable that has been set to NULL. Also note that a NULL byte ("\0") is not equivalent to the PHP NULL constant.

comment from manual :

isset doesn't reliably evaluate variables with blank strings (not necessarily NULL). i.e. $blankvar = ""; // isset will return true on this.

This is a very common pitfall when handling HTML forms that return blank text fields to the script. You're better off doing this:

if ($var != "") return true; else return false;

This more of a programming practice rather than the function's shortcomings. So if you have a habit of initializing variables you're likely to run into problems with isset() if your code or php project become very large.

Answer 2

The problem is definitely in page 3. As an educated guess I would say, that your "blank"-check if flawed.

You should use ie. a good regexp to test if the email is valid and make sure to remove whitespace before checking the length of the fields (ie - a space is not the same as an empty/blank field)

Answer 3

Is it possible that all those emails were generate by a bot crawling your site?

Can you reproduce the problem by calling curl on any of your pages?

Do any actions require a POST, or are you taking action with a GET?