0

我创建了一个联系我们表单，它应该简单且最重要的是安全，因此用户无法输入要在服务器端执行的代码：

<?php

$userips = ($_SERVER['X_FORWARDED_FOR']) ? $_SERVER['X_FORWARDED_FOR'] : $_SERVER['REMOTE_ADDR'];

$ips = $userips;

// Clean up the input values
foreach($_POST as $key => $value) {
  if(ini_get('magic_quotes_gpc'))
    $_POST[$key] = stripslashes($_POST[$key]);

  $_POST[$key] = htmlspecialchars(strip_tags($_POST[$key]));
}


// Assign the input values to variables for easy reference
$name = $_POST["name"];
$email = $_POST["email"];
$reason = $_POST["reason"];
$message = $_POST["message"];

mail($to, $subject, $message, $headers);

// Send the email
$to = "test@testsite.com";
$subject = "From: $name . " Reason: " . $reason";
$message = "$message" . "\n\n\n==-   Sent from the website with IP Address: " . $ips . "   -==";;
$headers = "From: $email";



$send_contact=mail($to,$subject,$message,$header);


header("Location: http://www.testsite.com");


// Check, if message sent to your email
// display message "We've recived your information"
// if($send_contact){
// echo "We've recived your contact information";
// }
// else {
// echo "ERROR";
// }
?>

上面的代码能完成这项工作吗？或者我是否缺少确保安全设置到位的代码？

编辑 我有以下检查电子邮件有效性的 Jquery 脚本：

'email' : function() {

    $('body').append('<div id="emailInfo" class="info"></div>');

    var emailInfo = $('#emailInfo');
    var ele = $('#email');
    var pos = ele.offset();

    emailInfo.css({
        top: pos.top-3,
        left: pos.left+ele.width()+15
    });

    var patt = /^.+@.+[.].{2,}$/i;

    if(!patt.test(ele.val())) {
        jVal.errors = true;
            emailInfo.html('<img src=theImages/xMark.png title="Please enter a valid email address" alt="Please enter a valid email address" />').show();
            ele.removeClass('normal').addClass('wrong');                    
    } else {
            emailInfo.html('<img src=theImages/checkMark.gif />').show();
            ele.removeClass('wrong').addClass('normal');
    }
},

使用上面的代码，我可以在 php 代码中将 ELSE 语句留空吗？

4

1 回答 1

3

您需要注意的是电子邮件注入。您可以使用以下方法对它们进行防御：

filter_var($email, FILTER_SANITIZE_EMAIL)

您的脚本有许多错误，包括解析错误：

<?php

$userips = ($_SERVER['X_FORWARDED_FOR']) ? $_SERVER['X_FORWARDED_FOR'] : $_SERVER['REMOTE_ADDR'];

$ips = $userips;

// Clean up the input values
foreach($_POST as $key => $value) {
  if(ini_get('magic_quotes_gpc'))
    $_POST[$key] = stripslashes($_POST[$key]);

  $_POST[$key] = htmlspecialchars(strip_tags($_POST[$key]));
}


// Assign the input values to variables for easy reference
$name = $_POST["name"];
$email = $_POST["email"];
$reason = $_POST["reason"];
$message = $_POST["message"];


if(filter_var($email, FILTER_SANITIZE_EMAIL)){
    // Send the email
    $to = "test@testsite.com";
    $subject = "From: $name Reason: $reason";
    $message = "$message" . "\n\n\n==-   Sent from the website with IP Address: " . $ips . "   -==";;
    $headers = "From: $email";

    $send_contact=mail($to,$subject,$message,$headers);
    header("Location: http://www.testsite.com");
}
else{
    echo 'Bold!';
}
?>
于 2012-08-31T14:52:52.053 回答