Re: Contact Form

#!usr/bin/perl
use CGI;
$query = new CGI;
#parse forms with cgi.pm

open MAIL,'|/usr/lib/sendmail -t' or die "error with email";

print MAIL "To: youremail@somewhere.com\n";
print MAIL "From: theiremail@somewhere.com\n";
print MAIL "Subject: form stuff\n";

print MAIL "name: ", $query->param(name), "\n";
print MAIL "subject: ", $query->param(subject), "\n";
print MAIL "email: ", $query->param(emailaddy), "\n";
print MAIL "message: ", $query->param(message), "\n";

close MAIL;

print "Location: thankyou.html\n\n"; #other ways, i just like it this 
+way
[download]

Comment on Re: Contact Form Download Code

Replies are listed 'Best First'.
•security alert, was Re: Re: Contact Form by merlyn (Sage) on Mar 23, 2002 at 00:00 UTC
`open MAIL,'\|/usr/lib/sendmail -t' or die "error with email"; print MAIL "name: ", $query->param(name), "\n"; print MAIL "subject: ", $query->param(subject), "\n"; print MAIL "email: ", $query->param(emailaddy), "\n"; print MAIL "message: ", $query->param(message), "\n";` [download] Ewww. No. You forgot the headers. So the mail isn't going anywhere, and worse yet, it's a security hole, since I can fake a "name" param with newlines and send spam using your script. Ick. Ewww. -- Randal L. Schwartz, Perl hacker	[reply] [d/l]
Re: •security alert, was Re: Re: Contact Form by Parham (Friar) on Mar 23, 2002 at 00:12 UTC
i didn't think it would have to be advanced, personally i'd do it your way, checking for my param's, but it was a quicky, very simple.	[reply]
•security alert TWO, was Re: Re: Contact Form by merlyn (Sage) on Mar 23, 2002 at 02:22 UTC
Oops. Twice in a row: `open MAIL,'\|/usr/lib/sendmail -t' or die "error with email"; print MAIL "To: youremail@somewhere.com\n"; print MAIL "From: theiremail@somewhere.com\n"; print MAIL "Subject: form stuff\n"; print MAIL "name: ", $query->param(name), "\n"; print MAIL "subject: ", $query->param(subject), "\n"; print MAIL "email: ", $query->param(emailaddy), "\n"; print MAIL "message: ", $query->param(message), "\n";` [download] You aren't ending your header with a blank line, so what you think is in the body is still in the header, and hence could be used for spam! Also, you have an "@" inside a double-quoted string, and you're using barewords for "name" and "subject", etc, so "use strict" will be all over your ass for both of those, and rightfully so. Maybe you should just concede at this point. -- Randal L. Schwartz, Perl hacker	[reply] [d/l]