这个联系表格代码有什么问题？

Question

This is my code for a simple contact form. All the emails successfully get sent however when they don't enter any information the supposedly error message that should appear doesn't and it sends an email blank. As I do not wish to have spam emails, what am I doing wrong?

Code:

<?php

$field_name = $_POST['name'];
$field_email = $_POST['email'];
$field_message = $_POST['message'];

$mail_to = 'myemail@goeshere';
$subject = 'Message from client: '.$field_name;

$body_message = 'From: '.$field_name."\n";
$body_message .= 'E-mail: '.$field_email."\n";
$body_message .= 'Message: '.$field_message;

$headers = 'From: '.$field_email."\r\n";
$headers .= 'Reply-To: '.$field_email."\r\n";

$mail_status = mail($mail_to, $subject, $body_message, $headers);

if ($mail_status) { ?>
    <script language="javascript" type="text/javascript">
        alert('Thank you for contacting us');
        window.location = 'index.html';
    </script>
<?php
}
else { ?>
    <script language="javascript" type="text/javascript">
        alert('Your message failed to send due to invalid credentials.');
        window.location = 'index.html';
    </script>
<?php
}
?>

The HTML form:

<form method="post" action="contact.php">
<div class="row half">
<div class="6u"><input type="text" class="text" name="name" placeholder="Name" /></div>
<div class="6u"><input type="text" class="text" name="email" placeholder="Email" /></div>
</div>
<div class="row half">
<div class="12u">
<textarea name="message" placeholder="Message"></textarea>
</div>
</div>
<div class="row">
<div class="12u">
<a href="#" class="button submit">Send Message</a>
</div>
</div>
</form>

Sorry if the code isn't indented properly...

Answer 1

You don't have any code that checks if the fields are filled in. You should check that the fields are set using isset() and that they contain valid data by using things like filter_var

Also, you should not be relying on JavaScript to do redirects, If the user has JavaScript disabled this won't work. Use PHP to do your redirect.

Answer 2

The code always sends the email, regardless of the validation status of the form. You can, instead, check the form validation before attempting to send the email. The overall logic would look like this:

• Parse user input
• Are required fields valid?
  • Yes: Send email, display success message
  • No: Display error message

In the code, it might be something as simple as:

$field_name = $_POST['name'];
$field_email = $_POST['email'];
$field_message = $_POST['message'];

if ($field_email != '') {
    // compose and send the email
    // display success message
} else {
    // display error message
}

For additional checks on the other fields, you'd add additional conditions to the if statement.

Answer 3

The mail function will return TRUE if the mail is accepted for delivery. Since all required parameters are present it will accept the mail even though the parameters are empty strings.

You would need to check if the input is valid or not.