One day I want to log on to my hosting account, but failed. Then I e-mailed web hosting support to help. I got a reply stated that one of my file (contact form) is not secure that someone from outside can execute and send spam email with the script.
To secure the script, you need to check the script is executed within your domain and from the provided form.
So here is the code, place it before you execute the send to mail script.
if(!(isset($_SERVER[’HTTP_REFERER’]) && !empty($_SERVER[’HTTP_REFERER’]) && stristr($_SERVER[’HTTP_REFERER’],$_SERVER[’HTTP_HOST’]))) {
print “Msg not sent.”; exit;
}
or a simpler one (just check it is submitted form a form)
if (!isset($_POST[’Submit’])) {
print ” Msg not sent’; exit;
}
If else statement is not just if else. You must think
- security (else statement for less secure operation)
- execution time (top if statement is the most frequently executed)
December 24th, 2006 by azwan in PHP | No Comments