|
-
Flash - Contact.PHP noob question
Hello,
I'm an squeeky clean newbie with flash. I've been managing to work my way around. My question is about this contact.php code I ran across. Can someone help me figure out where to update the email information?
<?php
//-----------------Getting data sent by flash---------------------
foreach ($_POST as $key => $value){
if ($key != 'mail_to' && $key != 'smtp_server' && $key != 'smtp_port' && $key != 'mail_from' && $key != 'mail_subject' && $key != 'plain_text'){
$mail_body .= '<b>'.str_replace('_',' ',$key).'</b>:<br/>';
$mail_body .= ''.stripslashes($value).'<br/>';
}
}
//-----------------------------------------------------------------
$message = '<html><body>'.$mail_body.'</body></html>'; // mail body
//------------if plain text is set to true removing html tags------
if ($_POST['plain_text']=='true') {
$message = str_replace('<br/>',"\r\n", $message);
$message = strip_tags($message);
//------------------------------------------------------------------
} else {
//----otherwise composing message headers---------------------------
$headers = 'MIME-Version: 1.0' . "\r\n";
$headers .= 'Content-type: text/html; charset=iso-8859-1' . "\r\n";
//------------------------------------------------------------------
}
//------------setting conf data-------------------------------------
$to = $_POST['mail_to'];
$from = $_POST['mail_from'];
$subject = $_POST['mail_subject'];
$smtp_server = $_POST['smtp_server'];
$smtp_port = $_POST['smtp_port'];
//------------------------------------------------------------------
//---------setting header info--------------------------------------
$headers .= 'To: '.$to. "\r\n";
$headers .= 'From: Site visitor ' .$from. "\r\n";
//------------------------------------------------------------------
if (mail($to, $subject, $message, $headers)){ // sending mail
print('&mail=1'); //succes
} else {
print('&mail=0');//failure
}
?>
-
Anyone? I'm sure it's a simple solution.
-
Hi,
may I suggest to remove
Code:
$to = $_POST['mail_to'];
and replace it by
This form is intended to get the destination from the web ... so any bad person can use it to send rubbish anywhere
Also I would like to recommend to add safeguards against line breaks in the subject and from fields - these could also be abused
Musicman
-
Thanks a bunch Musicman. You don't know how much you've helped me.
I'll look into how to safeguard the rest of the code.
Posting Permissions
- You may not post new threads
- You may not post replies
- You may not post attachments
- You may not edit your posts
-
Forum Rules
|
Click Here to Expand Forum to Full Width
|