Question

我创建了一个联系我们表单，该表单应该简单且最重要的是安全，因此用户无法输入要在服务器端执行的代码：

<?php

$userips = ($_SERVER['X_FORWARDED_FOR']) ? $_SERVER['X_FORWARDED_FOR'] : $_SERVER['REMOTE_ADDR'];

$ips = $userips;

// Clean up the input values
foreach($_POST as $key => $value) {
  if(ini_get('magic_quotes_gpc'))
    $_POST[$key] = stripslashes($_POST[$key]);

  $_POST[$key] = htmlspecialchars(strip_tags($_POST[$key]));
}


// Assign the input values to variables for easy reference
$name = $_POST["name"];
$email = $_POST["email"];
$reason = $_POST["reason"];
$message = $_POST["message"];

mail($to, $subject, $message, $headers);

// Send the email
$to = "test@testsite.com";
$subject = "From: $name . " Reason: " . $reason";
$message = "$message" . "\n\n\n==-   Sent from the website with IP Address: " . $ips . "   -==";;
$headers = "From: $email";



$send_contact=mail($to,$subject,$message,$header);


header("Location: http://www.testsite.com");


// Check, if message sent to your email
// display message "We've recived your information"
// if($send_contact){
// echo "We've recived your contact information";
// }
// else {
// echo "ERROR";
// }
?>

以上代码能完成这项工作吗？或者我缺少代码以确保安全性到位？

修改我有以下Jquery脚本来检查电子邮件的有效性：

'email' : function() {

    $('body').append('<div id="emailInfo" class="info"></div>');

    var emailInfo = $('#emailInfo');
    var ele = $('#email');
    var pos = ele.offset();

    emailInfo.css({
        top: pos.top-3,
        left: pos.left+ele.width()+15
    });

    var patt = /^.+@.+[.].{2,}$/i;

    if(!patt.test(ele.val())) {
        jVal.errors = true;
            emailInfo.html('<img src=theImages/xMark.png title="Please enter a valid email address" alt="Please enter a valid email address" />').show();
            ele.removeClass('normal').addClass('wrong');                    
    } else {
            emailInfo.html('<img src=theImages/checkMark.gif />').show();
            ele.removeClass('wrong').addClass('normal');
    }
},

使用上面的代码，我可以在php代码中留下ELSE语句空白吗？

Answer 1

您需要注意的是email injections。你可以使用以下方法对它们进行辩护：

filter_var($email, FILTER_SANITIZE_EMAIL)

您的脚本存在许多错误，包括解析错误：

<?php

$userips = ($_SERVER['X_FORWARDED_FOR']) ? $_SERVER['X_FORWARDED_FOR'] : $_SERVER['REMOTE_ADDR'];

$ips = $userips;

// Clean up the input values
foreach($_POST as $key => $value) {
  if(ini_get('magic_quotes_gpc'))
    $_POST[$key] = stripslashes($_POST[$key]);

  $_POST[$key] = htmlspecialchars(strip_tags($_POST[$key]));
}


// Assign the input values to variables for easy reference
$name = $_POST["name"];
$email = $_POST["email"];
$reason = $_POST["reason"];
$message = $_POST["message"];


if(filter_var($email, FILTER_SANITIZE_EMAIL)){
    // Send the email
    $to = "test@testsite.com";
    $subject = "From: $name Reason: $reason";
    $message = "$message" . "\n\n\n==-   Sent from the website with IP Address: " . $ips . "   -==";;
    $headers = "From: $email";

    $send_contact=mail($to,$subject,$message,$headers);
    header("Location: http://www.testsite.com");
}
else{
    echo 'Bold!';
}
?>

php联系我们表单问题

1 个答案: