0

My first try at PHP and I'm struggling. I don't want anyone hijacking my form to spam others. Will this do it? The form is in HTML and when you click submit it calls orderform.php via POST

<?php                        <!-- this is orderform.php -->
$to = 'myemail@myemil.com';  <!-- this is my hard coded email address-->
$subject = 'Order Form';

$message = 'First Name: '. filter_var($_POST['first_name']."\n", FILTER_SANITIZE_STRING)
        .'Last Name: '. filter_var($_POST['last_name']."\n", FILTER_SANITIZE_STRING)
        .'Mobile Phone: '. filter_var($_POST['phone']."\n", FILTER_SANITIZE_STRING)
        .'Email: '. filter_var($_POST['email'], FILTER_SANITIZE_EMAIL)."\n"
        .'Date: '. filter_var($_POST['date']."\n", FILTER_SANITIZE_STRING)
        .'Time: '. filter_var($_POST['time']."\n", FILTER_SANITIZE_STRING)
        .'Location: '. filter_var($_POST['location']."\n", FILTER_SANITIZE_STRING)
        .'Special Requests: '. filter_var($_POST['special']."\n", FILTER_SANITIZE_STRING)
    .'Service: '.$_POST['service']."\n"
    .'Package: '.$_POST['package']."\n"
    .'Photo Studio: '.$_POST['studio']."\n"
    .'Makeup: '.$_POST['makeup']."\n"
    .'Photo Editing: '.$_POST['editing'];

mail($to,$subject,$message);
header("Location: success.html");

?>

Thanks!!

Andrew
  • 1
  • 3
  • 4
    they can't because your `$to` is hard coded – vaso123 Nov 03 '14 at 10:39
  • Could use something similar too: http://stackoverflow.com/questions/12079947/securing-a-contact-form-script – chriz Nov 03 '14 at 10:40
  • Fantastic! So it's pretty secure from Hijackers... that's great news. Any other concerns or major flaws? Thanks! – Andrew Nov 03 '14 at 10:42
  • 2
    This question appears to be off-topic because it is requesting [a code review](http://codereview.stackexchange.com/) – Quentin Nov 03 '14 at 10:44
  • i am only expending @lolka_bolka comment. your `$to` is hard coded because of this line `$to = 'myemail@myemil.com';` in short they cant spam others, As its not some thing user can choose – arif_suhail_123 Nov 03 '14 at 10:48
  • Its security also somewhat hinges on your [local mail server configuration](http://stackoverflow.com/questions/5341802/is-there-any-injection-vulnerability-in-the-body-of-an-email), or on your mail client getting fuzzy from raw binary data posted into the text body (not very likely, but). – mario Nov 03 '14 at 10:50
  • Thanks both, that is extremely helpful... load off my mind :) – Andrew Nov 03 '14 at 12:02

0 Answers0