PHP电子邮件发送问题与验证字段

Question

I am facing an issue, I have successfully validated the input and required fields in my form. But if the user Submits the form, no matter if the fields are empty; it shows the error message with fields but also send the empty email.

I believe there is just a simple tweak that needs to be done. But I am lost. Please look into the below code I have:

<?php
$nameErr = $snameErr = $emailErr = $ownerNameErr = $ownerNatErr = $genderErr = $websiteErr = "";
$name = $sname = $regAddress = $email = $gender = $comment = $ownerName = $ownerNat = $website = "";

if ($_SERVER["REQUEST_METHOD"] == "POST")
{
   if (empty($_POST["name"]))
     {$nameErr = "Name is required";}
   else
     {
     $name = test_input($_POST["name"]);
     // check if name only contains letters and whitespace
     if (!preg_match("/^[a-zA-Z ]*$/",$name))
       {
       $nameErr = "Only letters and white space allowed"; 
       }
     }

if (empty($_POST["sname"]))
     {$snameErr = "Company Second Name is required";}
   else
     {
     $sname = test_input($_POST["sname"]);
     // check if name only contains letters and whitespace
     if (!preg_match("/^[a-zA-Z ]*$/",$sname))
       {
       $snameErr = "Only letters and white space allowed"; 
       }
     }

          extract($_POST);

     $to="example@example.com";
    $subject="Subject";
$body="<table width='100%' cellspacing='10' cellpadding='0'>
    <tr>
            <td style='color:blue;font-weight:bold;margin-left:500px;font-size:20px;' colspan='3'>My Form</td>
    </tr>

  <tr>
    <td>Name</td>
    <td>:</td>
    <td>$name</td>
  </tr>

<tr>
    <td>Second Choice</td>
    <td>:</td>
    <td>$sname</td>
  </tr>

</table>";
$headers  = 'MIME-Version: 1.0' . "\r\n";
$headers .= 'Content-type: text/html; charset=iso-8859-1' . "\r\n";
$headers .= 'From: MySite '."\r\n";
/*$headers .= 'Reply-To:'."$textfield5"."\r\n";*/



if(mail($to,$subject,$body,$headers))
{


       $msg = "Thank you for contacting us. We will get back to you soon.";
    /*$msg= "Successfully Sent";*/
}
else
{
    $msg= "msg not sent";
}

}

function test_input($data)
{
     $data = trim($data);
     $data = stripslashes($data);
     $data = htmlspecialchars($data);
     return $data;
}
?>

HTML Part

<span class="error">* <?php echo $ownerNatErr;?></span>
   <br><br>

   E-mail: <input type="text" name="email" value="<?php echo $email;?>">
   <span class="error">* <?php echo $emailErr;?></span>

   input type="submit" name="submit" value="Submit Information">

Any help/Suggestion is highly appreciated.

Regards.

Answer 1

Your validation is correct and I assume it does what you want, however: you do not prevent the mail() function from running if the validation fails.

You could do this:

if ($valid) {
    if (mail(...) {
        ...
    } else {
        ...
    }
 }

This $valid variable sou should set to true by default and in the if statement, where you set the error messages, you should the variable to false .

This way the mail function would be called if the input is valid only.

Cheers.

Answer 2

You check the parameters for errors and set some error messages but your code calls mail anyway, even if you found an error.

You might want to add some conditions:

if($snameErr === '' && $nameErr === '' ...) {
  // call mail here, check whether it was successful and
  // tell the user about it
} else {
  // show error message or something else
}

By the way, I guess your code is vulnerable because you use extract($_POST) . An attacker might inject arbitrary variables and can therefore bypass your checks.