I too have seen this on many of my customer accounts so I went in and secured most of them by using Cookies and sessions...
Now of course you will want to tailor these pages to meet your needs, I also left out the JavaScript to validate the form however, once I put these pages in place, it brought it to a screeching hault..
File Name: contact.php - This page just sets the Cookie and Session and provides the form for the users, if you don't have a session and cookie, the next page just bounces you out...
PHP Code:
<?php
$value = 'THE_Contact';
//clear session variables
session_unset();
//prevents caching
setcookie("THE_Cookie", $value);
header ("Expires: Mon, 26 Jul 2001 05:00:00 GMT"); // Date in the past
header ("Last-Modified: ".gmdate("D, d M Y H:i:s")." GMT"); // Always modified
header ("Cache-Control: no-cache, must-revalidate"); // HTTP/1.1 Protocol
header ("Pragma: no-cache");
session_cache_limiter();
session_start();
$_SESSION['SSID'] = session_id();
$topheader="contact";
?>
Code:
<form name="frm_1" action="contacts.php" method="POST" onSubmit='return PostSearchForm();'>
<input type="hidden" name="SSID" value="<?= $_SESSION['SSID']; ?>">
<table cellpadding="4" cellspacing="0" border="0">
<tr>
<td><b>First Name:</b></td>
<td width="7px"></td>
<td><input class="inputbox" type="TEXT" name="fname" maxlength="40"></td>
</tr>
<tr>
<td><b>Last Name:</b></td>
<td width="7px"></td>
<td><input class="inputbox" type="TEXT" name="lname" maxlength="40"></td>
</tr>
<tr>
<td><b>Email address:</b></td>
<td width="7px"></td>
<td><input class="inputbox" type="TEXT" name="cemail" maxlength="100"></td>
</tr>
<tr>
<td><b>Company:</b></td>
<td width="7px"></td>
<td><input class="inputbox" type="TEXT" name="cname" maxlength="100"></td>
</tr>
<tr>
<td><b>Telephone Number:</b></td>
<td width="7px"></td>
<td><input class="inputbox" type="TEXT" name="telno" maxlength="100"></td>
</tr>
<tr>
<td><b>Subject:</b></td>
<td width="7px"></td>
<td><input class="inputbox" type="TEXT" name="csubject" maxlength="60" value=""></td>
</tr>
<tr>
<td valign="TOP"><b>Message:</b><br></td>
<td width="7px"></td>
<td> </td>
</tr>
<tr>
<td valign="TOP" colspan="3"><textarea class="inputbox" wrap="physical" rows="5" cols="35" name="comments" maxlength="1000"></textarea> </td>
</tr>
<tr>
<td></td>
<td width="7px"></td>
<td>
<p><input type="image" border="0" value="submit" src="images/submit.gif"> <a href="javascript:document.frm_1.reset();"><img border="0" src="images/clear.gif"></a><input type="hidden" name="action" value="submit"></p>
</td>
</tr>
</table>
</form>
And then next is the reciever page...
File Name: contacts.php - This page captures the Cookie and the session, if it sees it, it deletes it! This prevents the bots and others from resubmitting over and over again. This also checks to make sure it came from a valid referrer (your server) and not a bot....
PHP Code:
<?php
if (!isset($_SESSION['count'])) {
$_SESSION['count'] = 0;
} else {
$_SESSION['count']++;
}
if ($_SESSION['count'] >0){
include ('index.php');
//echo 'Session Count too High';
exit;
}
if($_GET['SSID'] == $_SESSION['SSID']){
//Do Nothing
} else {
include ('index.php');
//echo 'No SSID';
exit;
}
if (isset($_COOKIE['THE_Cookie'])){
$cookiesSet = array_keys($_COOKIE);
for ($x=0;$x<count($cookiesSet);$x++) setcookie($cookiesSet[$x],"",time()-1);
} else {
include ('index.php');
//echo 'Cookie not set';
exit;
}
// ------- variables you MUST change below -------------------------------------------------------
$valid_ref1="http://yourdomain.com/contact.php";// change "yourdomain" to your domain
$valid_ref2="http://www.yourdomain.com/contact.php";// change "WWW.yourdomain" to your domain
$replyemail="admin@yourdomain.com";//change to your email address
$name = $fname . ' ' . $lname;
if ($REMOTE_ADDR == "") $ip = "no ip";
else $ip = getHostByAddr($REMOTE_ADDR);
$date = date("Y-m-d H:i:s");
// ------- optional text you can change below -----------------------------------------------------
$error_msg='ERROR - not sent. Try again.';
$success_sent_msg='<p align="center"><strong> </strong></p>
<p align="center"><strong>Your message has been successfully sent to us<br>
</strong> and we will reply as soon as possible.</p>
<p align="center">A copy and of your query has been sent to you.</p>
<p align="center">Thank you for contacting us.</p>';
$replymessage = "Hi $name
Thank you for your email.
We will reply to you shortly using the email address you provided ( $cemail ).
Please DO NOT reply to this email.
Below is a copy of the message you submitted:
--------------------------------------------------
Subject: $csubject
--------------------------------------------------
Message:
$comments
--------------------------------------------------
Thank you
The THE Management";
// ----------no more changes required below here --------------------------------------------------
// email variable not set - load $valid_ref1 page
if (!isset($HTTP_POST_VARS['cemail']))
{
echo "<script language=\"JavaScript\"><!--\n ";
echo "top.location.href = \"$valid_ref1\"; \n// --></script>";
exit;
}
$ref_page=$_SERVER["HTTP_REFERER"];
$valid_referrer=0;
if($ref_page==$valid_ref1) $valid_referrer=1;
elseif($ref_page==$valid_ref2) $valid_referrer=1;
if(!$valid_referrer)
{
echo "<script language=\"JavaScript\"><!--\n alert(\"$error_msg\");\n";
echo "top.location.href = \"$valid_ref1\"; \n// --></script>";
exit;
}
$themessage = "A visitor at has left the following information\n
Name: $name
Company Name: $cname
Phone Number: $telno
The visitor commented:
------------------------------
Subject: $csubject\n
$comments
Logged Info :
------------------------------
Using: $HTTP_USER_AGENT
Hostname: $ip
IP address: $REMOTE_ADDR
Date/Time: $date";
mail("$replyemail",
"$query_relates_to: $csubject",
"$themessage",
"From: $cemail\nReply-To: $cemail");
mail("$cemail",
"Receipt: $csubject",
"$replymessage",
"From: $replyemail\nReply-To: $replyemail");
?>
<?php echo $success_sent_msg; ?>
Good luck!
-xisn
LinkBack URL
About LinkBacks
SPAM sent from php contact form...
Reply With Quote
Originally Posted by SpringChicken
