<?php
// This function checks for email injection. Specifically, it checks for carriage returns - typically used by spammers to inject a CC list.
function isInjected($str) {
$injections = array('(\n+)',
'(\r+)',
'(\t+)',
'(%0A+)',
'(%0D+)',
'(%08+)',
'(%09+)'
);
$inject = join('|', $injections);
$inject = "/$inject/i";
if(preg_match($inject,$str)) {
return true;
}
else {
return false;
}
}
// Load form field data into variables.
$email_address = $_REQUEST['email_address'] ;
$comments = $_REQUEST['comments'] ;
// If the user tries to access this script directly, redirect them to feedback form,
if(!isset($_REQUEST['email_address'])) {
header( "Location: index.html" );
}
// If the form fields are empty, redirect to the error page.
elseif (empty($email_address) || empty($comments)) {
header( "Location: ErrorPage.html" );
}
// If email injection is detected, redirect to the error page.
elseif ( isInjected($email_address) ) {
header( "Location: ErrorPage.html" );
}
// If we passed all previous tests, send the email!
else {
date_default_timezone_set('America/Los_Angeles');
//echo date('l jS \of F Y h:i:s A');
//echo " ... testing the mail() function " ;
$from = "youraccountname@yourdomain"; // MUST BE LEGIT ACCOUNT ON YOUR DOMAIN
$to="
[email protected]" ; // CURRENTLY, not blocked by hotmail!
$mailbody= $email_address."
".$comments;
$subject="Site Email" ;
$headers = "Content-type: text/plain; charset=windows-1251 \r\n"; // MUST BE text/plain
$headers .= "From: $from\r\n";
$headers .= "Reply-To: $from\r\n";
$headers .= "MIME-Version: 1.0\r\n";
$headers .= "X-Mailer: PHP/" . phpversion();
$resp = mail($to, $subject, $mailbody, $headers);
if( $resp ){
header( "Location: ErrorPage.html" );
}else{
header( "Location: ErrorPage.html" );
}
?>