Php Contact Form

Answer 1

This is very complicated (script you wrote). Essentially you need two scripts, one for ajax and second one normal php contact form. Lets call the first one ajax.php (both script contain sam validation rules), when user enters for example his mail (you bind jquery blur event to email) a request is sent to...

ajax.php?action=checkmail&[email protected]

You can then print return by email input box, eg "Your email is valid." or contrary.

You can also use only ajax.php to send mail by passing all parameters to it, and then showing user "email is sent" or "email is not sent because..." without refreshing the page.

Answer 2

Well this is quite nice solution, a working one. I've seen much worst around.
Only a few notes.

• it has some unnecessary validations, say contains_bad_str(body); is useless. And whole "bad words" approach at all. Newline test is enough
• just a rule: DO NOT TALK TO STRANGERS. Never talk to possible attacker, providing them with any feedback. All these "Suspected injection attempt" are childish and more of it - it supply an attacker with information they can use. Always send just 500 HTTP error in all these cases and nothing else.
• you're using pretty unusual way of error handling. I can't understand the difference between these code snippets

why the first one just sets a variable

if(trim($_POST['emailTo']) == '') {
    $hasError = true;

and second one prints an error and exits?

if (!is_valid_email($email)) {
  echo 'Invalid email submitted - mail not being sent.';
  exit;
}

Will you provide a fair user with any feedback on error occurred? Something like "Please fill all required fields"?

• I wouldn't make user supplied e-mail subject but rather some hardcoded sentence, like Feedback from ".$_SERVER['HTTP_HOST']. I'd like to distinguish feedback messages in my mailbox from the regular ones. (I wouldn't make that fancy reply-to feature either, but it's my own preference)

• stripslashes thing. Why only message? Aren't other fields behave the same? And at least you have check get_magic_quotes_gpc() before applying. I'd make it automated, at hte top of the script, both stripslashes and trim, just in the loop over $_POST array.

Answer 3

I'd suggest that three year old error-ridden articles from phpbuilder.com are probably not the best source to be using to concoct your own mailer. Instead, I'd be using something more up-to-date like the validate and sanitize filters in PHP 5 SPL.

I'd also take a look at PHPMailer or some other library that will perform security checks for you.