ViMaSter/hackertours-theme
Watch
0
0
Fork
You've already forked hackertours-theme
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Some improvments to the php contact example script. Enforce maximum message length. Strip carriage returns and newlines from headers.

Browse source
This commit is contained in:
Fredrik Jonsson 2026-03-17 09:49:25 +01:00
commit d71843573e
1 changed files with 17 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

22
php/contact.php.example
View file

@ -6,6 +6,9 @@ $address = 'info@example.com';
// Set the e-mail subject prefix. // Set the e-mail subject prefix.
$prefix = 'Website feedback'; $prefix = 'Website feedback';
// Maximum allowed message length in characters.
$max_message_length = 5000;
// DO NOT EDIT ANYTHING BELOW UNLESS YOU KNOW WHAT YOU ARE DOING. // DO NOT EDIT ANYTHING BELOW UNLESS YOU KNOW WHAT YOU ARE DOING.
$error = false; $error = false;
@ -43,11 +46,16 @@ else {
$error = true; $error = true;
} }
// Enforce maximum message length.
if (isset($_POST['message']) && strlen($_POST['message']) > $max_message_length) {
$error = true;
}
if (!$error) { if (!$error) {
// Construct the mail with headers. // Construct the mail with headers.
$name = _contact_clean_str($_POST['name'], ENT_QUOTES, true, true); $name = _contact_clean_str($_POST['name'], ENT_QUOTES, true, true, true);
$prefix = _contact_clean_str($prefix, ENT_NOQUOTES, true, true); $prefix = _contact_clean_str($prefix, ENT_NOQUOTES, true, true, true);
$subject = _contact_clean_str($_POST['subject'], ENT_NOQUOTES, true, true); $subject = _contact_clean_str($_POST['subject'], ENT_NOQUOTES, true, true, true);
$subject = "[$prefix] $subject"; $subject = "[$prefix] $subject";
$message = _contact_clean_str($_POST['message'], ENT_NOQUOTES); $message = _contact_clean_str($_POST['message'], ENT_NOQUOTES);
$lines = explode("\n", $message); $lines = explode("\n", $message);
@ -83,11 +91,15 @@ function _contact_ff_wrap(&$line) {
$line = wordwrap($line, 72, " \n"); $line = wordwrap($line, 72, " \n");
} }
function _contact_clean_str($str, $quotes, $strip = false, $encode = false) { function _contact_clean_str($str, $quotes, $strip_tags = false, $strip_newlines = false, $encode = false) {
if ($strip) { if ($strip_tags) {
$str = strip_tags($str); $str = strip_tags($str);
} }
if ($strip_newlines) {
$str = str_replace(["\r", "\n"], '', $str);
}
$str = htmlspecialchars(trim($str), $quotes, 'UTF-8'); $str = htmlspecialchars(trim($str), $quotes, 'UTF-8');
if ($encode && preg_match('/[^\x20-\x7E]/', $str)) { if ($encode && preg_match('/[^\x20-\x7E]/', $str)) {