Jag har ett problem med mitt mailformulär. Jag har börjat fått spam i det och jag har kört Acunetix Web Vulnerability Scanner och sett jag det finns lite säkerhetshål i mitt mailformulär. Vad skulle man kunna göra för att bli av med spam och göra formuläret säkrare utan för mycket arbete. Tacksam för all hjälp jag kan få.
Kontaktsidan
<script language="javascript">
function check()
{
var reg = new RegExp("^[A-Za-z0-9_]{1,}[.]?[A-Za-z0-9_]{1,}@{1}([A-Za-z0-9_]+[.]{1})+[A-Za-z0-9_]{1,}$");
if(document.to.txt_name.value=="")
{
alert("Fyll i ditt namn.");
document.to.txt_name.focus();
return false;
}
if(document.to.txt_email.value=="")
{
alert("Fyll i din e-postadress.");
document.to.txt_email.focus();
return false;
}
else if(!reg.test(document.to.txt_email.value))
{
alert("Felaktig e-post. Försök igen");
document.to.txt_email.focus();
return false;
}
if(document.to.txt_message.value=="")
{
alert("Meddelande kan ej lämnas tom.");
document.to.txt_message.focus();
return false;
}
else
{
return true;
}
}
</script><br />
<form action="includes/mail.php" method="post" name="to">
<div id="contactform">
<?php if($_GET[mailmsg]=="1") { ?>
<div id="contact_action" align="center"><?php echo "Meddelandet har skickats.";?></div>
<?php
}
?>
<table width="100%" border="0" cellspacing="0" cellpadding="0">
<tr>
<td colspan="2" class="formtitle">Kontaktformulär</td>
</tr>
<tr>
<td colspan="2" height="10"></td>
</tr>
<tr>
<td width="100" class="leftmessage">Namn:</td>
<td width="250"><input name="txt_name" type="text" class="msgbox" id="txt_name" width="200px"></td>
</tr>
<tr>
<td class="leftmessage">E-post:</td>
<td><input type="text" id="txt_email" name="txt_email" width="200px" class="msgbox"></td>
</tr>
<tr>
<td class="leftmessage">Meddelande: </td>
<td><textarea cols="40" rows="5" name="txt_message" id="txt_message" width="200px" class="msgbox"></textarea></td>
</tr>
<tr>
<td> </td>
<td height="30"><table width="170" border="0" cellspacing="0" cellpadding="0">
<tr>
<td><input name="sendmail" type="submit" class="msgbutton" onclick="return check();" value="Skicka"/></td>
<td width="10"> </td>
<td><input name="cancel" type="reset" class="msgbutton" value="Radera"></td>
</tr>
</table>
</td>
</tr>
</table></div>
</form>
mail.php
<?php session_start();
include("../admin/includes/connection.php");
function contains_newlines($str_to_test) {
if(preg_match("/(%0A|%0D|\\n+|\\r+)/i", $str_to_test) != 0) {
echo "newline found in $str_to_test. Suspected injection attempt - mail not being sent.<br />";
//echo "here you must use the exit or die php functions to finish the script.<br /><br />";
exit;
}
}
if($_POST)
{
$adminEmailRes = mysql_fetch_array(mysql_query("SELECT * FROM tbl_admin"));
$adminEmail = $adminEmailRes[email];//die();
$NAME_NEW = $_POST['txt_name'];
$EMAIL_NEW = $_POST['txt_email'];
$SUBJECT_NEW = "Meddelande från hemsidan";
$MESSAGE_NEW = $_POST['txt_message'];
$IP = $_SERVER['REMOTE_ADDR'];
if($_SERVER['REQUEST_METHOD'] != "POST"){
echo "Unauthorized attempt to access page.<br />";
//echo "here you must use the exit or die php functions to finish the script.<br /><br />";
exit;
}
contains_newlines($EMAIL_NEW);
$html_message.='<table width="100%" border="0" cellpadding="3" cellspacing="3">';
$html_message.='<tr><td width="100%"> </td></tr>';
$html_message.='<tr><td width="100%">'.$NAME_NEW.', E-post: '.$EMAIL_NEW.'</td></tr>';
$html_message.='<tr><td width="100%">IP-nummer: '.$IP.'</td></tr>';
$html_message.='<tr><td width="100%">'.nl2br($MESSAGE_NEW).'</td></tr>';
$html_message.='</table>';
$email_from_addr = $EMAIL_NEW; // actual email address of the sender
$email_from_name = $NAME_NEW;//$from_display_name; // display name, if any, that the sender wishes to use
$email_subject = $SUBJECT_NEW; // The Subject of the email
$email_txt = $html_message; // Message that the email has in it
$email_to = $adminEmail; // Who the email is to
$headers .= $email_from_name == '' ? "From: ".$email_from_addr : "From: ".$email_from_name." <".$email_from_addr.">";
$semi_rand = md5(time());
$mime_boundary = "==Multipart_Boundary_x{$semi_rand}x";
$headers .= "\nMIME-Version: 1.0\n" .
"Content-Type: multipart/mixed;\n" .
" boundary=\"{$mime_boundary}\"";
$email_message .= "This is a multi-part message in MIME format.\n\n" .
"--{$mime_boundary}\n" .
"Content-Type:text/html; charset=\"iso-8859-1\"\n" .
"Content-Transfer-Encoding: 7bit\n\n" .
$email_txt .
//$ok = mail($email_to, $email_subject, $email_message, $headers);
$ok = mail($email_to,$email_subject,$email_message,$headers);
}
?>
<script language="javascript">location.href="../index.php?pageid=<?php echo $_SESSION['sessPageId'];?>&mailmsg=1";</script>