Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.lang.php > #1240

Re: My contact form is not emailed to me

Show all headers | View raw

"Jerry Stuckle"  wrote in message news:iojo5j$jpo$1@dont-email.me...

On 4/19/2011 12:33 AM, P E Schoen wrote:

>> I realize that, but the authorized names and emails are hard coded in
>> the PHP script which is invoked from the HTML form using POST
>> variables. Of course, a hacker could figure that out and use his own
>> form to try to access the script for mass emailing or whatever, but he
>> would not get past the authentication without somehow knowing the
>> names and addresses, and then also the password.

> Which isn't that hard if you aren't using secure socket layer (https:...).

The only way I understand would be possible to do this is by listening to 
the data over the network and identifying the CGI variables with that 
information. I suppose that is possible if someone was using a public 
network to access the PHP script. But I doubt that a hacker would want to 
put in that much effort. The content is being used for public announcements 
anyway, so the data is not sensitive.

>> The headers are pretty much hard-coded as well, except for including
>> the name and email address of the user in the subject. Since they both
>> must pass strict authentication, additional malevolent headers cannot
>> be injected there. Everything else is formatted in the body of the
>> message, which is passed through the purifier.

> But the subject and from headers are NOT being properly authenticated
> in the code you posted earlier.

The subject and from headers are as follows:

    $subject = "Form data from {$in['Full_Name']}";
    //This has been validated from a hard-coded list
    $sender = "paul@example.com";
    $recipient= 'paul@example.com' ;
    mail( $recipient, $subject, $message, "From: $sender" );

I see that I have used my email address for both the sender and recipient. 
I'm not really sure why I did that, but IIRC I was having problems and I 
thought it was because the email was actually sent from my server's email 
function and the sender had to match. So the subject is actually used to 
indicate who had used the entry form.

> That's where you need to study and learn.  It isn't that hard,
> but it does take some studying.

Yes, if this were a major part of what I do, then I'd have to do that. But I 
have found that the people who submit activity listings do not even try to 
make use of this, so I will probably just have to maintain the website 
manually. It may be helpful to me to use this system, but otherwise it has 
become mostly a learning experience, and that just in a small way. Most of 
my time is spent on electronic engineering, PIC code, and Windows 
application programming. And also checking out newsgroups such as this for 
interesting discussions.

> Sure, you can hire someone to check your code - but you'll be
> much better off reading and learning on your own so you can
> write secure code.

> Coding publicly available websites isn't that hard - but it does
> take care to ensure they are secure.

> There are way too many ways a hacker can get in for a verifier to
> try to hack your site.  And hackers come up with new ways every
> day.  It would be even harder to keep up with ways of hacking
> sites than it is for antivirus manufacturers to keep ahead of
> virus makers.

I can see that, but maybe there are some common attack modes that could be 
attempted to see how vulnerable a site may be. Even if it required human 
interaction, at would be a valuable service that I would be willing to pay 
for. It's difficult for a beginner with limited time and motivation to learn 
all the methods of attack and the usual ways to reduce vulnerability.

Perhaps you could provide a link to the PHP code for a secure form mailing 
application?

Thanks,

Paul 

Back to comp.lang.php | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

My contact form is not emailed to me nathanir <rajeshn923@gmail.com> - 2011-04-16 00:36 -0700
  Re: My contact form is not emailed to me Jerry Stuckle <jstucklex@attglobal.net> - 2011-04-16 10:04 -0400
    Re: My contact form is not emailed to me nathanir <rajeshn923@gmail.com> - 2011-04-16 07:36 -0700
      Re: My contact form is not emailed to me Jerry Stuckle <jstucklex@attglobal.net> - 2011-04-16 16:11 -0400
      Re: My contact form is not emailed to me "P E Schoen" <paul@pstech-inc.com> - 2011-04-16 16:25 -0400
        Re: My contact form is not emailed to me Jerry Stuckle <jstucklex@attglobal.net> - 2011-04-16 17:40 -0400
          Re: My contact form is not emailed to me nathanir <rajeshn923@gmail.com> - 2011-04-17 10:27 -0700
            Re: My contact form is not emailed to me "MG" <nospam@nospam.com> - 2011-04-17 21:58 +0200
              Re: My contact form is not emailed to me Jerry Stuckle <jstucklex@attglobal.net> - 2011-04-17 16:39 -0400
                Re: My contact form is not emailed to me "P E Schoen" <paul@pstech-inc.com> - 2011-04-18 22:30 -0400
                Re: My contact form is not emailed to me Jerry Stuckle <jstucklex@attglobal.net> - 2011-04-18 22:58 -0400
                Re: My contact form is not emailed to me "P E Schoen" <paul@pstech-inc.com> - 2011-04-19 00:33 -0400
                Re: My contact form is not emailed to me Jerry Stuckle <jstucklex@attglobal.net> - 2011-04-19 06:29 -0400
                Re: My contact form is not emailed to me "P E Schoen" <paul@pstech-inc.com> - 2011-04-20 13:46 -0400
                Re: My contact form is not emailed to me The Natural Philosopher <tnp@invalid.invalid> - 2011-04-20 18:51 +0100
                Re: My contact form is not emailed to me "P E Schoen" <paul@pstech-inc.com> - 2011-04-20 16:41 -0400
                Re: My contact form is not emailed to me Jerry Stuckle <jstucklex@attglobal.net> - 2011-04-20 16:59 -0400
                Re: My contact form is not emailed to me Jerry Stuckle <jstucklex@attglobal.net> - 2011-04-20 16:55 -0400
                Re: My contact form is not emailed to me "P E Schoen" <paul@pstech-inc.com> - 2011-04-20 19:58 -0400
                Re: My contact form is not emailed to me Jerry Stuckle <jstucklex@attglobal.net> - 2011-04-20 23:44 -0400
                Re: My contact form is not emailed to me "P E Schoen" <paul@pstech-inc.com> - 2011-04-21 04:04 -0400
                Re: My contact form is not emailed to me Jerry Stuckle <jstucklex@attglobal.net> - 2011-04-21 06:29 -0400
                Re: My contact form is not emailed to me "P E Schoen" <paul@pstech-inc.com> - 2011-04-21 04:31 -0400
                Re: My contact form is not emailed to me Jerry Stuckle <jstucklex@attglobal.net> - 2011-04-21 06:32 -0400
                Re: My contact form is not emailed to me crankypuss <no@email.thanks> - 2011-04-21 04:37 -0600
                Re: My contact form is not emailed to me "P E Schoen" <paul@pstech-inc.com> - 2011-04-21 13:42 -0400
                Re: My contact form is not emailed to me "Mr. B-o-B" <mr.chew.baka@gmail.com> - 2011-04-21 15:21 -0500
                Re: My contact form is not emailed to me Jerry Stuckle <jstucklex@attglobal.net> - 2011-04-21 20:04 -0400
                Re: My contact form is not emailed to me "P E Schoen" <paul@pstech-inc.com> - 2011-04-22 00:45 -0400
                Re: My contact form is not emailed to me The Natural Philosopher <tnp@invalid.invalid> - 2011-04-22 11:07 +0100
                Re: My contact form is not emailed to me Jerry Stuckle <jstucklex@attglobal.net> - 2011-04-22 07:07 -0400
                Re: My contact form is not emailed to me "P E Schoen" <paul@pstech-inc.com> - 2011-04-22 15:28 -0400
                Re: My contact form is not emailed to me "P E Schoen" <paul@pstech-inc.com> - 2011-04-23 04:32 -0400
                Re: My contact form is not emailed to me "Peter H. Coffin" <hellsop@ninehells.com> - 2011-04-22 08:23 -0500

csiph-web