PHP Contact Form Submitting Randomly

Question

I hope I'm missing something pretty basic here but: An empty form is getting submitted randomly, sometimes 3-8 times a day, then none for a few days and so on.

The empty submits always email with the subject as "[Website Contact Form]." Even though there is no validation in my php, in the html code the subject is chosen from a drop-down menu with the default as "General Enquiry." Notice in the php code below, there is no way for a human to submit an empty form with the above subject line, that is, it would always be "[Website Contact Form]General Enquiry" if I press submit without entering anything.

I have contact.html call this contact.php file:

<?
   $email = 'info@mail.com';
   $mailadd = $_POST['email'];
   $headers = 'From: ' . $_POST['email'] . "\r\n";
   $name = $_POST['name'];
   $subject = '[Website Contact Form] ' . $_POST['subject'];
   $message = 'Message sent from: ' . $name . '. Email: ' . $mailadd . '. Organization: ' . $_POST['company'] . '. Phone: ' . $_POST['phone'] . '. ';
   $message .= 'Message: ';
   $message .= $_POST['message'];

   if (mail($email,$subject,$message, $headers)) {
    echo "<p>Thank You! We'll get back to you shortly.</p>";
   }
   else {
    echo "<p>Error...</p>";
   }
?>

I use this code for many websites, but have never encountered this issue. Is there something so obviously wrong with this code that I'm missing? Any help would be greatly appreciated!

Answer 1

I suspect that you may not be checking that these variables are set before you send the email. Someone requesting contact.php directly (without any form data) may produce the results you have described. If this is the case, the following code should work like a charm:

<?php
    if (isset($_POST['submit']) {
        // form code
    }
    else {
        // The form was not submitted, do nothing
    }
?>

Even if that's not that case, such a simple check is always good practice.

Furthermore, you should always validate any user input just as a good habit. You don't want your server flooding your inbox with emails. I suggest using regexs to validate the input provided and possibly use a captcha service (such as ReCaptcha).

Answer 2

If you've been using this code and it's been working fine then I'd check what variables you changed with this case for example your submit form.

Try out your form with all common possibilities and see if it works. And empty Subject will give your form the subject "[Website Contact Form]". Check that your script actually get's the post variables and your form submits the right variables. Your dropdown might have an option with value of "" and the innerHTML "General Enquiry". The value is what will get submitted.

It's good to check inputs server-side as well

<?php 
      if(isset($_POST['subject'],$_POST['email'])){

      }
?>