Member Avatar for cristian.stilpeanu.1_1

Hi guys, I struggled for few days to find a php code that work's to this form contact. Please if someone know's help me. Thank you!

<form action="index.php#contact" method="post">
<div id="box-message">
</div>
<p class="clearfix">
<input type="text" name="name" value="" placeholder="Name" required="required" />
<input type="email" name="email" value="" placeholder="Email" required="required" />
<input type="text" name="website" value="" placeholder="Website" />
</p>
<p>
<textarea cols="109" rows="9" name="query" placeholder="Your message" required="required"></textarea>
<input type="hidden" name="_token" value="63cec6911de36c0b920850d85316773d" />
<input type="submit" value="Submit" />
</p>
</form>
  • 3 Contributors
  • 2 Replies
  • 356 Views
  • 52 Minutes Discussion Span
  • Latest Post Latest Post by Member #120589

Dani AI

Generated

Quick summary and practical next steps for — the HTML form itself is fine, but what’s missing is a dedicated server-side handler and the usual server-side checks. correctly asked where the data should go (email, DB, file) — pick one and follow the appropriate workflow. is right that the hidden value is likely a CSRF token; it must be validated server-side (and regenerated per session) rather than relied on visually.

Essential checklist before accepting and sending/storing contact data:

  • Send the form to a dedicated handler (eg. contact-handler.php) instead of posting to index.php.
  • Require POST and validate the CSRF token with session state (use hash_equals when available).
  • Validate and sanitize inputs: trim strings, use filter_var for email/URL, limit message length.
  • Prevent email header injection: reject CR/LF sequences in name/email fields.
  • When sending mail, use a site-controlled From (noreply@domain) and put the user address in Reply-To.
  • For reliability use an SMTP library (PHPMailer, etc.) on production; use prepared statements (PDO) when saving to a database.
  • Log failures and return appropriate HTTP status codes so failures can be diagnosed.

Example minimal handler (adapt before use):

<?php
session_start();
if ($_SERVER['REQUEST_METHOD'] !== 'POST') { http_response_code(405); exit; }
if (empty($_POST['_token']) || !isset($_SESSION['_token']) || !hash_equals($_SESSION['_token'], $_POST['_token'])) { http_response_code(400); exit; }

$name = trim($_POST['name'] ?? '');
$email = trim($_POST['email'] ?? '');
$message = trim($_POST['query'] ?? '');

if (!$name || !$email || !$message || !filter_var($email, FILTER_VALIDATE_EMAIL)) { http_response_code(422); exit; }

if (preg_match("/[\r\n]/", $name) || preg_match("/[\r\n]/", $email)) { http_response_code(400); exit; }

$to = 'contact@yourdomain.com';
$subject = 'Website contact';
$body = "Name: $name\nEmail: $email\n\n$message\n";
$headers = "From: noreply@yourdomain.com\r\nReply-To: $email\r\nContent-Type: text/plain; charset=utf-8\r\n";

if (mail($to, $subject, $body, $headers)) { http_response_code(200); echo 'OK'; } else { http_response_code(500); echo 'Mail failed'; }

Troubleshooting notes: if mail never arrives, the host may block mail(); test with SMTP or log the message to a file first, and check server/mail logs. Regenerate and unset CSRF tokens after use.

Recommended Answers

All 2 Replies

Member Avatar for Aeonix

How are you planning to send this contact through? You want this in database, in a file, through email, what is the output you're expecting?

Also I believe <input type="hidden" /> is still visible in source-code, just so you know.

Member Avatar for Member #120589

:

The hidden token here is probably CSRF protection - that's the usual way to present it. It has to be sent with the form and you don't want it visible, spoiling the visuals of said form.

I can't see anything wrong with your form. Is the 'action' correct? We don't usually send forms to the index page of our sites. This form should be sent to its own form handler, e.g. 'handlers/send_email.php'

You do not show what happens to the submitted data, so we have absolutely no idea what you're doing. If you don't have any code at all, didn't you search the manual?

http://php.net/manual/en/function.mail.php

http://www.w3schools.com/php/func_mail_mail.asp

http://www.w3schools.com/php/php_forms.asp

http://stackoverflow.com/questions/5335273/how-to-send-an-email-using-php

Just the first 4 results for 'send mail php'

If you can't use Google or Bing - perhaps they're banned in your country? You can search this forum - we have about 10 new threads per month on this very issue.

Edited by Member #120589
commented: I see, thanks. +3
Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.