making form processing script more secure

Question

what are some steps I can use to make this more secure?

<?php
foreach ($_POST as $field=>$value)
{
$formcontent .= "$field: $value\n";
}
$formcontent .= 'User-Agent: '.$_SERVER['HTTP_USER_AGENT'];


$recipient = "****.***y@***********.co.uk";
$subject = "Event feedback form";
$mailheader = "From: web.form@**********.co.uk\r\n";
$mailheader .= "Reply-To: $email\r\n";
$mailheader .= "MIME-Version: 1.0\r\n";


mail($recipient, $subject, $formcontent, $mailheader) or die("Failure!");
header("location:http://www.**********.co.uk");
?>

What do you mean by making this script secure? You are not storing data in database, so what "secure" means here? — WatsMyName
– WatsMyName, Commented Aug 23, 2012 at 9:24

Community · Accepted Answer · 2017-05-23 12:01:49Z

2

Take a look at the recommended answer here: Is this mail() function safe from header injection?. Since you aren't storing in your database or using attachments, your risks are in the possibility of new lines in the header of the mail. If you follow those instruction there, you can filter out the new lines and you are okay.

Hope that helps! Cheers

edited May 23, 2017 at 12:01

CommunityBot

11 silver badge

answered Aug 23, 2012 at 9:25

scott

1,0701 gold badge9 silver badges21 bronze badges

Sign up to request clarification or add additional context in comments.

Comments

futuregeek · Accepted Answer · 2012-08-23 09:23:59Z

1

You may want to apply htmlentities to $value to prevent cross site scripting.

$formcontent .= "$field: " . htmlentites($value) . "\n";

Otherwise, its okay, as your values don't go into DB.

answered Aug 23, 2012 at 9:23

futuregeek

2842 silver badges8 bronze badges

Comments

rsz · Accepted Answer · 2012-08-23 09:24:48Z

1

Use htmlspecialchars to sanitize the variables!

answered Aug 23, 2012 at 9:24

rsz

1,1611 gold badge18 silver badges38 bronze badges

Collectives™ on Stack Overflow

making form processing script more secure

3 Answers 3

Comments

Comments

Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

3 Answers 3

Comments

Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related