i have a php code inside my website to a quotation form that has java script for making

 name , telephone number and email

rquired fields before submiting the form and its working fine but a few day ago i found that someone is sending me alot of junk for that form and he send the form empty is that means that he could access my files i mean like hacking or how he could do that

<form id="forma" method="post" action="quatation.php"> 

        <div id="infoq">
          <label id="namelab" for="namea"><span>* </span><?php _e ("Name", "my_theme");?></label> 
            <input  type="text" name="namea" id="namea" value="" size="22" tabindex="1" class="rounded" required aria-required='true' pattern="^([a-zA-Z\u0600-\u06ff\ufb50-\ufdff\ufe70-\ufeff]+)$" title="Your name (no special characters, diacritics are okay)"
                 spellcheck="false"/> <br />

        <label id="emaillb" for="email"><span>* </span><?php _e ("Email", "my_theme");?></label> 
<input type="email" name="email" id="email" value="" size="22" tabindex="2" class="rounded" required aria-required='true' 
                title="Your email address" spellcheck="false" /> <br />

            <label id="phonelb" for="phonea"><span>* </span>Phone</label> 


this is the form but the problem is when i used to put the quatation.php file in the theme file it gives me error

Not Found The requested URL /quatation.php was not found on this server

so i put it outside could that be the reason ?

  • If you are in doubt of your coding skills, it's easier to use a plugin like Contact Form 7 to create your form.
    – RRikesh
    Aug 14, 2013 at 5:46

2 Answers 2


It may possible that he is trying to hack. I am sure you are storing form data after escaping/sanitizing the content which eliminate the risk of Sql injection

enter image description here

and since user can submit empty form it mean you haven done the server side validation. what you need to check is

  1. First check that weather field is set or not
  2. name can only contain latter for example [a-zA-Z] (for english)
  3. phone number can only contain digit [0-9]
  4. validate email formate (you can also use FILTER_VALIDATE_EMAIL)
  5. use captcha code (Google's recaptcha is quite good)

Good Read

  1. Validating Sanitizing and Escaping User Data
  2. Data Validation
  3. Chris Shiflett : security articles (heighly recomended reading)
  • Never used but you can also use plugin like Contact Form 7 but i highly recommend reading source code of plugin first to know what exactly its doing Aug 14, 2013 at 6:10
  • i am realy sorry but i am a beginner what do you mean by "First check that weather field is set or not" and i added my code so you can see it and i wanted to know if it could be the problem that the quotation.php is not inside the content folder
    – sarah
    Aug 14, 2013 at 6:57
  • do server side validation .. and my first is exactly what Puggan Se is telling Aug 14, 2013 at 7:03

you need the same checks, coded in php, at the php that recives the post-data from the form.

a simple version could be:

if(!isset($_POST['name']) OR strlen(isset($_POST['name'])) < 4)
    die("Name is required to be at least 4 character long.\n");
if(!isset($_POST['telephone number']) OR strlen(isset($_POST['telephone number'])) < 4)
    die("telephone number is required to be at least 4 character long.\n");
if(!isset($_POST['email']) OR strlen(isset($_POST['email'])) < 4)
    die("email is required to be at least 4 character long.\n");
  • checking weather set or not isnt the only thing to care Aug 14, 2013 at 5:55
  • 1
    It's a good start, the list of things to do to protect yourself is long, you added a bit more, but it could also include checking the against blacklist, spam filtering like Akismet, time mesurments, and captcha
    – Puggan Se
    Aug 14, 2013 at 6:05
  • where i could add this code ? to function.php ?
    – sarah
    Aug 14, 2013 at 7:15
  • your forms action-attribute says the reciver is the quatation.php
    – Puggan Se
    Aug 14, 2013 at 8:46
  • yes do you mean i should add something like this to qutation.php
    – sarah
    Aug 15, 2013 at 5:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.