PHP联系表单在所有字段中提交1

Question

I've recently developed a website for a freelance client of mine, and within their website is a Contact Form and a Request for Estimate form. 我最近为我的自由客户开发了一个网站，在他们的网站中有一个联系表和一个估算请求表。

Once a day, both forms are being submitted and emailed to the designated email address. 每天一次，两种表格都将提交并通过电子邮件发送到指定的电子邮件地址。 However, the submitted forms are clearly not from a real user, this is because all of the fields contain the number 1. For example, the name field will be Name:1, and the address field will be Address:1. 但是，提交的表单显然不是来自真实用户的，这是因为所有字段都包含数字1。例如，名称字段将为Name：1，而地址字段将为Address：1。 The number 1 is repeated for all input text fields, and even radio and check box form fields. 对于所有输入文本字段，甚至是单选和复选框表单字段，都重复数字1。

Below is a copy of the PHP file that I am using to submit the Request for Estimate form. 以下是我用来提交“估算请求”表单的PHP文件的副本。

<?
$subject="Associated Sennott Contractors Request For Estimate From:".$_GET['firstname'];
$headers= "From: ".$_GET['email']."\n";
$headers.='Content-type: text/html; charset=iso-8859-1';
mail("email@gmail.com", $subject,  "
    <html>
        <head>
            <title>Associated Sennott Contractors Request For Estimate</title>
    </head>
<body>
    <p><strong>Associated Sennott Contractors Request For Estimate</strong></p>
    <p>
        First Name: ".$_GET['firstname']." <br />
        Last Name: ".$_GET['lastname']." <br />
        Company Name: ".$_GET['company']." <br />
        Address 1: ".$_GET['address1']." <br />
        Address 2: ".$_GET['address2']." <br />
        City: ".$_GET['city']." <br />
        State: ".$_GET['state']." <br />
        Zip: ".$_GET['zip']." <br />
        Phone: ".$_GET['phone']." <br />
        Fax: ".$_GET['fax']." <br />
        Email: ".$_GET['email']." <br /><br />

        <strong>Property Type:</strong><br />
        Residential Single Family: ".$_GET['singlefamily']." <br />
        Residential Multi-Family: ".$_GET['multifamily']." <br />
        Residential Out-Building : ".$_GET['outbuilding']." <br />
        Commercial Office: ".$_GET['commercial']." <br />
        Retail Store: ".$_GET['retail']." <br />
        Restaurant: ".$_GET['restaurant']." <br />
        Industrial Building: ".$_GET['industrial']." <br /><br />

        <strong>Requested Services:</strong><br />
        Fire, Water or Wind Damage Restoration: ".$_GET['restoration']." <br />
        Scope of Loss Estimate to Insurance Company: ".$_GET['scope']." <br />
        Smoke Odor Remediation: ".$_GET['smoke']." <br />
        Exterior Remodeling or Siding: ".$_GET['exterior']." <br />
        Interior Remodeling: ".$_GET['interior']." <br />
        Hardwood and Laminate Flooring: ".$_GET['flooring']." <br />
        Finish Carpentry: ".$_GET['carpentry']." <br />
        Demolition and Debris Removal: ".$_GET['demo']." <br />
        Exterior Decks, Patios and Fencing: ".$_GET['patio']." <br />
        Other: ".$_GET['other']." <br /><br />

        <strong>Additional Information:</strong><br />
        Message: ".$_GET['info']."
    </p>  
</body>
</html>" , $headers);
header( 'Location: thankyou.html' ) ;
?>

You can also view the PHP code by follow the link here: http://sennottcontractors.com/home-repair-estimate/quote-code.html 您也可以通过以下链接查看PHP代码： http : //sennottcontractors.com/home-repair-estimate/quote-code.html

You can then view the HTML code for the actual form below: 然后，您可以在下面查看实际表单的HTML代码：

<!DOCTYPE>
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<title>Request An Estimate Form</title>
<script type="text/javascript">
function formSubmit()
{
document.getElementById("estimate-form").submit();
}
</script>

</head>
<body>
<fieldset>
<legend><h3>Request a Home Restoration Estimate</h3></legend>
    <form id="estimate-form" name="estimate-form" target="_parent" method="get" action="quote.php" onsubmit='return formValidator()'>
        <p><strong>Contact Information</strong></p>
            <p>First Name: *<br />
            <input type="text" size="40" name="firstname" id="firstname" /></p>
            <p>Last Name: *<br />
            <input type="text" size="40" name="lastname" id="lastname" /></p>
            <p>Company Name:<br />
            <input type="text" size="40" name="company" id="company" /></p>
            <p>Address 1: *<br />
            <input type="text" size="40" name="address1" id="address1" /></p>
            <p>Address 2:<br />
            <input type="text" size="40" name="address2" id="address2" /></p>
            <p>City: *<br />
            <input type="text" size="30" name="city" id="city" /></p>
            <p>State: *<br />
            <input type="text" size="5" name="state" id="state" /></p>
            <p>Zip: *<br />
            <input type="text" size="10" name="zip" id="zip" /></p>
            <p>Phone: *<br />
            <input type="text" size="20" name="phone" id="phone" /></p>
            <p>Fax:<br />
            <input type="text" size="20" name="fax" id="fax" /></p>
            <p>Email: *<br />
            <input type="text" size="40" name="email" id="email" /></p>
        <br />
        <p><strong>Property Type</strong> *</p>
            <p><input type="checkbox" name="singlefamily" id="singlefamily"/> Residential Single Family</p>
            <p><input type="checkbox" name="multifamily" id="multifamily"/> Residential Multi-Family <em>(Condominium, apartment, town house, ect)</em></p>
            <p><input type="checkbox" name="outbuilding" id="outbuilding"/> Residential Out-Building <em>(Garage, shed, ect)</em></p>
            <p><input type="checkbox" name="commercial" id="commercial"/> Commercial Office</p>
            <p><input type="checkbox" name="retail" id="retail"/> Retail Store</p>
            <p><input type="checkbox" name="restaurant" id="restaurant"/> Restaurant</p>
            <p><input type="checkbox" name="industrial" id="industrial"/> Industrial Building</p>
        <br />
        <p><strong>Requested Services</strong> *</p>
            <p><input type="checkbox" name="restoration" id="restoration"/> Fire, Water or Wind Damage Restoration</p>
            <p><input type="checkbox" name="scope" id="scope"/> Scope of Loss Estimate to Insurance Company</p>
            <p><input type="checkbox" name="smoke" id="smoke"/> Smoke Odor Remediation</p>
            <p><input type="checkbox" name="exterior" id="exterior"/> Exterior Remodeling or Siding</p>
            <p><input type="checkbox" name="interior" id="interior"/> Interior Remodeling</p>
            <p><input type="checkbox" name="flooring" id="flooring"/> Hardwood and Laminate Flooring</p>
            <p><input type="checkbox" name="carpentry" id="carpentry"/> Finish Carpentry</p>
            <p><input type="checkbox" name="demo" id="demo"/> Demolition and Debris Removal</p>
            <p><input type="checkbox" name="patio" id="patio"/> Exterior Decks, Patios and Fencing</p>
            <p><input type="checkbox" name="other" id="other"/> Other</p>
        <br />
    <p><strong>Additional Information</strong><br />
    Please provide any information regarding details of your home restoration project or additional information to your requested services.</p>
    <p><textarea rows="10" cols="65" id="info" name="info"></textarea></p>
    <button type="submit" id="submit" onclick="formSubmit()">Submit</button>
    </form>
    <p>* Required Fields</p>
</fieldset>
</body>
</html>

The Request an Estimate form that is using the PHP file and code mentioned above you can view by following the link here: http://sennottcontractors.com/home-repair-estimate/index.html 您可以通过以下链接查看使用上面提到的PHP文件和代码的“请求估算”表单： http : //sennottcontractors.com/home-repair-estimate/index.html

Again, both the Request an Estimate form and the Contact Form are being submitted once a day, everyday, with the number 1 in every form field. 同样，每天都提交一次“请求估算”表单和“联系表单”，每个表单字段中的数字均为1。

My guess is that this may be an issue with the PHP file itself, or it may be an issue from the server side of the hosted website. 我的猜测是这可能是PHP文件本身的问题，或者可能是托管网站的服务器端的问题。

Please help!!! 请帮忙！！！

Answer 1

There's nothing technically wrong with your form. 您的表格在技术上没有任何问题。 You said the cause of the issue yourself: "... the submitted forms are clearly not from a real user ...". 您自己说了问题的原因：“ ...提交的表格显然不是来自真实用户的……”。 So the solution is to make your form anti-bot. 因此，解决方案是使您的表单成为反僵尸程序。 See this question on the pro Webmasters site for how you can do this: Make your site anti-bot? 有关如何操作的信息，请在专业版网站管理员网站上看到此问题：使您的网站成为反机器人程序？

Answer 2

One part of this problem is that you need to use a form nonce or "token". 此问题的一部分是您需要使用表单随机数或“令牌”。

Form.php Form.php

<?php
session_start();

$_SESSION['token'] = md5(mt_rand() . unique_id('form', TRUE));

...

?>
<form>
<input type="hidden" value="<?php print $_SESSION['token']; ">
...
</form>

process.php process.php

<?php
session_start();

if($_SESSION['token'] !== $_POST['token'])
{
    die('They did not load the form!');
}

...

(validation)

...

$db->insert($record);

Answer 3

You're not doing any validation. 您没有进行任何验证。 What do you expect? 你能指望什么？

Anyone could just grab the form fields, create the URL (because you're using GET instead of POST), and submit it ad nauseum if they wanted to. 任何人都可以抓住表单字段，创建URL（因为您使用的是GET而不是POST），然后在需要时立即将其提交。 What you're probably encountering is a bot trying to figure out if it can hijack your form to send emails where it wants to send them. 您可能遇到的是一个机器人，试图弄清楚它是否可以劫持您的表单以将电子邮件发送到想要发送的地方。

What you should do is switch to using POST and check the $_SERVER['HTTP_REFERER'] variable to make sure it's coming from your form (at least). 您应该做的是切换到使用POST并检查$_SERVER['HTTP_REFERER']变量，以确保它来自表单（至少）。 You could also use a CAPTCHA, but those are becoming increasingly unreliable. 您也可以使用CAPTCHA，但是这些正变得越来越不可靠。 You could take this further and use a validation class to set rules for each field and what kind of data is allowed to be in each one. 您可以更进一步，并使用验证类为每个字段设置规则，并允许每个字段中包含哪种数据。

Forms are easily manipulated, so if you expect to have any integrity in your form submissions, you should be doing the validation on the server-side. 表单易于操作，因此，如果您希望表单提交具有任何完整性，则应该在服务器端进行验证。 Client-side validation doesn't hurt, but only use it for user experience purposes, not to ensure data integrity. 客户端验证不会受到损害，而只是将其用于用户体验目的，而不是确保数据完整性。

PHP联系表单在所有字段中提交1

问题描述

3 个解决方案

解决方案1
2 2012-08-07 16:52:40

解决方案2
2 2012-08-07 17:01:18

解决方案3
1 2012-08-07 16:53:58

PHP联系表单在所有字段中提交1

问题描述

3 个解决方案

解决方案1 2 2012-08-07 16:52:40

解决方案2 2 2012-08-07 17:01:18

解决方案3 1 2012-08-07 16:53:58

解决方案1
2 2012-08-07 16:52:40

解决方案2
2 2012-08-07 17:01:18

解决方案3
1 2012-08-07 16:53:58