Take the 2-minute tour ×
WordPress Development Stack Exchange is a question and answer site for WordPress developers and administrators. It's 100% free, no registration required.

i have a php code inside my website to a quotation form that has java script for making

 name , telephone number and email

rquired fields before submiting the form and its working fine but a few day ago i found that someone is sending me alot of junk for that form and he send the form empty is that means that he could access my files i mean like hacking or how he could do that

<form id="forma" method="post" action="quatation.php"> 

        <div id="infoq">
          <label id="namelab" for="namea"><span>* </span><?php _e ("Name", "my_theme");?></label> 
            <input  type="text" name="namea" id="namea" value="" size="22" tabindex="1" class="rounded" required aria-required='true' pattern="^([a-zA-Z\u0600-\u06ff\ufb50-\ufdff\ufe70-\ufeff]+)$" title="Your name (no special characters, diacritics are okay)"
                 spellcheck="false"/> <br />

        <label id="emaillb" for="email"><span>* </span><?php _e ("Email", "my_theme");?></label> 
<input type="email" name="email" id="email" value="" size="22" tabindex="2" class="rounded" required aria-required='true' 
pattern="^(([-\w\d]+)(\.[-\w\d]+)*@([-\w\d]+)(\.[-\w\d]+)*(\.([a-zA-Z]{2,5}|[\d]{1,3})){1,2})$"
                title="Your email address" spellcheck="false" /> <br />

            <label id="phonelb" for="phonea"><span>* </span>Phone</label> 




*

this is the form but the problem is when i used to put the quatation.php file in the theme file it gives me error

Not Found The requested URL /quatation.php was not found on this server

so i put it outside could that be the reason ?

share|improve this question
    
If you are in doubt of your coding skills, it's easier to use a plugin like Contact Form 7 to create your form. –  RRikesh Aug 14 '13 at 5:46
add comment

2 Answers

It may possible that he is trying to hack. I am sure you are storing form data after escaping/sanitizing the content which eliminate the risk of Sql injection

enter image description here

and since user can submit empty form it mean you haven done the server side validation. what you need to check is

  1. First check that weather field is set or not
  2. name can only contain latter for example [a-zA-Z] (for english)
  3. phone number can only contain digit [0-9]
  4. validate email formate (you can also use FILTER_VALIDATE_EMAIL)
  5. use captcha code (Google's recaptcha is quite good)

Good Read

  1. Validating Sanitizing and Escaping User Data
  2. Data Validation
  3. Chris Shiflett : security articles (heighly recomended reading)
share|improve this answer
    
Never used but you can also use plugin like Contact Form 7 but i highly recommend reading source code of plugin first to know what exactly its doing –  NullPoiиteя Aug 14 '13 at 6:10
    
i am realy sorry but i am a beginner what do you mean by "First check that weather field is set or not" and i added my code so you can see it and i wanted to know if it could be the problem that the quotation.php is not inside the content folder –  sarah Aug 14 '13 at 6:57
    
do server side validation .. and my first is exactly what Puggan Se is telling –  NullPoiиteя Aug 14 '13 at 7:03
add comment

you need the same checks, coded in php, at the php that recives the post-data from the form.

a simple version could be:

if(!isset($_POST['name']) OR strlen(isset($_POST['name'])) < 4)
{
    die("Name is required to be at least 4 character long.\n");
}
if(!isset($_POST['telephone number']) OR strlen(isset($_POST['telephone number'])) < 4)
{
    die("telephone number is required to be at least 4 character long.\n");
}
if(!isset($_POST['email']) OR strlen(isset($_POST['email'])) < 4)
{
    die("email is required to be at least 4 character long.\n");
}
share|improve this answer
    
checking weather set or not isnt the only thing to care –  NullPoiиteя Aug 14 '13 at 5:55
1  
It's a good start, the list of things to do to protect yourself is long, you added a bit more, but it could also include checking the against blacklist, spam filtering like Akismet, time mesurments, and captcha –  Puggan Se Aug 14 '13 at 6:05
    
where i could add this code ? to function.php ? –  sarah Aug 14 '13 at 7:15
    
your forms action-attribute says the reciver is the quatation.php –  Puggan Se Aug 14 '13 at 8:46
    
yes do you mean i should add something like this to qutation.php –  sarah Aug 15 '13 at 5:20
show 2 more comments

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.