Form to email help

[jack0987]

I am not a php person and need some help, please.

I have the following rudementary form to email code.
(I did not write this code.)
It is in a file named mail.php on the server.

PHP Code:

<?PHP 

$to = "me@this.com";

$subject = "Results from your Request Info form"; 

$headers = "From: My Site"; 

// redirect? 1=yes 0=no
$forward = 0; 
$location = "mysite.com"; 

$date = date ("l, F jS, Y"); 
$time = date ("h:i A"); 

$msg = "Below is the result of your feedback form. It was submitted on $date at time.\n\n"; 

if ($_SERVER['REQUEST_METHOD'] == "POST") {
    foreach ($_POST as $key => $value) { 
        $msg .= ucfirst ($key) ." : ". $value . "\n"; 
    }
}
else {
    foreach ($_GET as $key => $value) { 
        $msg .= ucfirst ($key) ." : ". $value . "\n"; 
    }
}

mail($to, $subject, $msg, $headers); 
if ($forward == 1) { 
    header ("Location:$location"); 
} 
else { 
    echo "Thank you for submitting our form. We will get back to you as soon as possible."; 
} 

?>

The following is a typical response:

Below is the result of your feedback form.
It was submitted on Friday, February 1st, 2013 at 03:30 PM.

name : test
Phone : asdf
Email : sdfg@sdfg.com
Submit : Submit Request


THe code works fine when called from the web page with the form except every now and then I get an email without the fields such as this:

Below is the result of your feedback form.
It was submitted on Friday, February 1st, 2013 at 05:30 PM.


I discovered that if you access the mail.php file directly by typing

http://mysite.com/mail.php

in your browser you get an email without the fields.


Is there a better way of doing this?

Any comments would be helpful. Thanks.

[student101]

Start here:
http://www.codingforums.com/showthre...68#post1144368

[elem]

if all you want is to prevent users from accessing the mail.php themselves then just add

PHP Code:

if(isset($_POST)) {

//your content

}

else {

echo "Forbidden";
//or
header('Location: index.php'); //which will bring them back to home page

} 


[jack0987]

Thanks so much for the replies.

Actually elem I did do something very similar to that yesterday.

I have a suspicion that it is being done intentionally. For what it's worth, perhaps I could catch the http line or ip address but I do not know how to do that.

[elem]

Do you mean that someone is intentionally pressing send without filling out any fields? Then you could write a few lines that would check if all the fields are filled out, if not form wouldn't be sent. Or install captcha or some other anti-spam script, if you suspect it is not a human ...

[jack0987]

No, I think someone may be running the mail.php directly. As far as I can tell it is the only way the email would be totally blank - have no field names at all. If they were hitting submit the field names would be present but empty.

[student101]

Originally Posted by jack0987

No, I think someone may be running the mail.php directly. As far as I can tell it is the only way the email would be totally blank - have no field names at all. If they were hitting submit the field names would be present but empty.

Edit: reference

You still getting blank emails after applying the above?

[jack0987]

No. The above application corrects it. Thanks.

I think I may still like to catch the IP and http line that runs it perhaps.