Question

当我填写联系表单中的所有字段时，它会一直转到错误页面。我不知道为什么会这样。我希望联系表格将所有信息发送给我的个人电子邮件。我看了几乎所有的解决方案，但似乎无法解决问题。

我的表单代码是：

<div id="form">
    <form action="sendmail.php" method="post">
    <p>
        <label for="name">Name:</label>
        <input name="name" id="name" type="text" class="required">
        <span>Please enter your name</span>
    </p>
    <p>
        <label for="email">Email:</label>
        <input name="email" id="email" type="text" class="required"> 
        <span>Please enter a valid email address</span>
    </p>

    <p>
        <label for="subject">Subject:</label>
        <input name="subject" id="subject" type="text"> 
        <span>Please enter your subject</span>
    </p>
    <p>
        <label for="message">Message</label>
        <textarea name="message" id="message" class="required"></textarea> 
        <span>Please enter your message</span>
    </p>
    <p class="submit">
        <input type="submit" value="Submit" class="btn-submit">
    </p>
    </form>
</div>

我的PHP代码是：

<?php

// This function checks for email injection. Specifically, it checks for carriage returns 
$injections = array('(\n+)',
    '(\r+)',
    '(\t+)',
    '(%0A+)',
    '(%0D+)',
    '(%08+)',
    '(%09+)'
);

$inject = join('|', $injections);
$inject = "/$inject/i";
if(preg_match($inject,$str)) {
    return true;
}
else {
    return false;
}


// Load form field data into variables.
$name = $_REQUEST['name'] ;
$email = $_REQUEST['email'] ;
$subject = $_REQUEST['subject'] ;
$message = $_REQUEST['message'] ;


// If the user tries to access this script directly, redirect them to feedback form,
if (!isset($_REQUEST['email'])) {
    header( "Location: contact.html" );
}

// If the form fields are empty, redirect to the error page.
elseif (empty($email_address) || empty($comments)) {
    header( "Location: error.html" );
}

// If email injection is detected, redirect to the error page.
//elseif ( isInjected($email) ) {
    // header( "Location: error.html" );
}

// If we passed all previous tests, send the email!
else {
    mail( "f.ajibade@f-sharpmedia.com", "Feedback Form Results",
    $comments, "From: $email" );
    header( "Location: thankyou.html" );
}
?>

Answer 1

因为您没有将电子邮件检查逻辑放入函数中，所以返回语句将阻止代码执行，即使它是真的。正确的方法是：

if(preg_match($inject,$str)) {
  //process
}
else {
  exit();
}

修改

以下是如何将该逻辑放入函数

/** *This function checks for email injection. *Specifically, it checks for carriage returns *@return Boolean upon failure or success */ function has_injection($email){ $injections = array('(\n+)', '(\r+)', '(\t+)', '(%0A+)', '(%0D+)', '(%08+)', '(%09+)' ); $inject = join('|', $injections); $inject = "/$inject/i"; if(preg_match($inject,$email)) { return true; } else { return false; } }

然后使用它：

<?php if(!has_injection($_REQUEST['email']){ //process code }else{ die('terminating script because of email injection!'); }

Answer 2

代码非常混乱

$ str设置在哪里？

你检查注射：if(preg_match($inject,$str))，但是什么是$ str？

你检查empty($email_address) || empty($comments) 但这些不是你设置的变量（你设置$email = $_REQUEST['email'], $message = $_REQUEST['message']等）。

联系表单不会提交并继续进入错误页面

2 个答案: