0

I get a message that says the form was submitted successfully, but no email is received. My current contact form works but I get too much spam. I tried modifying with recaptcha examples from here, but none seem to show how to actually send an email with the information entered in the contact form. Here is my PHP code:

<?php
$name   = $_POST['name'];
$email   = $_POST['email'];
$phone   = $_POST['phone'];
$message   = $_POST['message'];
$token  = $_POST['token'];
$action = $_POST['action'];
$from = 'Glass & Tile Works Website'; 
$to = 'glassandtileworks@gmail.com'; 
$subject = 'New website lead';
$body = "From: $name\n E-Mail: $email\n Message:\n $message\n Phone:\n $phone";

if ($_POST['submit']) {
$curlData = array(
    'secret' => 'My secret key',
    'response' => $token
);

$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, "https://www.google.com/recaptcha/api/siteverify");
curl_setopt($ch, CURLOPT_POST, 1);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($curlData));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
$curlResponse = curl_exec($ch);

$captchaResponse = json_decode($curlResponse, true);

if ($captchaResponse['success'] == '1' && $captchaResponse['action'] == $action && 
$captchaResponse['score'] >= 0.5 && $captchaResponse['hostname'] == $_SERVER['SERVER_NAME']) {
    echo 'Form Submitted Successfully';
} else {
    echo 'You are not a human';
}
}
lumisi
  • 9

1 Answers1

2

Nowhere in your script do you call any mail function. Consider reading the documentation about mail.

Also, if you use the native PHP mail() function, your script is going to be vulnerable to mail header injection and might become an open relay. I'd strongly suggest that you inspect and validate all of those $_POST variables -- to make sure they don't have new line characters in them, for instance. Better yet, use some existing mail library like PHPMailer or use the mail functions of some framework like Laravel or CodeIgniter.

S. Imp
  • 2,833
  • 11
  • 24
  • Thank you. I'm a newbie, but that helped. – lumisi Jun 22 '20 at 20:25
  • Second part of your comment is too complicated for my technical know how. Can I still be spammed even though I'm using recaptcha? – lumisi Jun 22 '20 at 20:27
  • The only thing recaptcha does for you, is to slow down bot submissions. Any malicious person can still enter garbage in the fields, despite answering a legit recaptcha challenge. – IncredibleHat Jun 22 '20 at 20:40