Contact Form

[venimfrogtongue]

I realise I am really new to perl and what I am asking might sound stupid or too easy for all you real guru's to even help me with. But hey, I want to learn perl more than anything!!! This is my second project I want to design: a simple contact form. My question is this. How could I do something like a FOR statement and get the result similar to:

for ('name',
     'subject',
     'emailaddy',
     'message);
{
print qq($main : $_ <br>)
## whereas $main would hold the words 'name', 'subject' etc. so in the
+ end I get results in my email like:

name: Joe
subject: Help
emailaddy: [e-mail]
message: Lalala

Thanks for all your help in advance. And please remember, I am not just looking for the code, I want to know what is going on. Thanks millions! venimfrogtongue

[merlyn]

use CGI qw(:all);
open M, "|/usr/lib/sendmail -t" or die "Cannot open sendmail: $!";
print M <<'END';
To: [e-mail]
From: [e-mail]
Subject: the results of your form

END
for (param) {
  my @values = param($_);
  print M "$_: ", join(", ", @values), "\n";
}
close M;
print header, start_html, p("Thank you for your submission!\n"), end_h
+tml;

-- Randal L. Schwartz, Perl hacker

[Parham]

#!usr/bin/perl
use CGI;
$query = new CGI;
#parse forms with cgi.pm

open MAIL,'|/usr/lib/sendmail -t' or die "error with email";

print MAIL "To: [e-mail]\n";
print MAIL "From: [e-mail]\n";
print MAIL "Subject: form stuff\n";

print MAIL "name: ", $query->param(name), "\n";
print MAIL "subject: ", $query->param(subject), "\n";
print MAIL "email: ", $query->param(emailaddy), "\n";
print MAIL "message: ", $query->param(message), "\n";

close MAIL;

print "Location: thankyou.html\n\n"; #other ways, i just like it this 
+way

[merlyn]

open MAIL,'|/usr/lib/sendmail -t' or die "error with email"; 
 
print MAIL "name: ", $query->param(name), "\n"; 
print MAIL "subject: ", $query->param(subject), "\n"; 
print MAIL "email: ", $query->param(emailaddy), "\n"; 
print MAIL "message: ", $query->param(message), "\n";

Ewww. No. You forgot the headers. So the mail isn't going anywhere, and worse yet, it's a security hole, since I can fake a "name" param with newlines and send spam using your script. Ick. Ewww.

-- Randal L. Schwartz, Perl hacker

[Parham]

i didn't think it would have to be advanced, personally i'd do it your way, checking for my param's, but it was a quicky, very simple.

[merlyn]

Oops. Twice in a row:

open MAIL,'|/usr/lib/sendmail -t' or die "error with email"; 
 
print MAIL "To: [e-mail]\n"; 
print MAIL "From: [e-mail]\n"; 
print MAIL "Subject: form stuff\n"; 
 
print MAIL "name: ", $query->param(name), "\n"; 
print MAIL "subject: ", $query->param(subject), "\n"; 
print MAIL "email: ", $query->param(emailaddy), "\n"; 
print MAIL "message: ", $query->param(message), "\n";

You aren't ending your header with a blank line, so what you think is in the body is still in the header, and hence could be used for spam! Also, you have an "@" inside a double-quoted string, and you're using barewords for "name" and "subject", etc, so "use strict" will be all over your ass for both of those, and rightfully so.

Maybe you should just concede at this point.

-- Randal L. Schwartz, Perl hacker