Re: Contact Form

[Parham]

in reply to Contact Form

#!usr/bin/perl
use CGI;
$query = new CGI;
#parse forms with cgi.pm

open MAIL,'|/usr/lib/sendmail -t' or die "error with email";

print MAIL "To: [e-mail]\n";
print MAIL "From: [e-mail]\n";
print MAIL "Subject: form stuff\n";

print MAIL "name: ", $query->param(name), "\n";
print MAIL "subject: ", $query->param(subject), "\n";
print MAIL "email: ", $query->param(emailaddy), "\n";
print MAIL "message: ", $query->param(message), "\n";

close MAIL;

print "Location: thankyou.html\n\n"; #other ways, i just like it this 
+way

[merlyn]

open MAIL,'|/usr/lib/sendmail -t' or die "error with email"; 
 
print MAIL "name: ", $query->param(name), "\n"; 
print MAIL "subject: ", $query->param(subject), "\n"; 
print MAIL "email: ", $query->param(emailaddy), "\n"; 
print MAIL "message: ", $query->param(message), "\n";

Ewww. No. You forgot the headers. So the mail isn't going anywhere, and worse yet, it's a security hole, since I can fake a "name" param with newlines and send spam using your script. Ick. Ewww.

-- Randal L. Schwartz, Perl hacker

[Parham]

i didn't think it would have to be advanced, personally i'd do it your way, checking for my param's, but it was a quicky, very simple.

[merlyn]

Oops. Twice in a row:

open MAIL,'|/usr/lib/sendmail -t' or die "error with email"; 
 
print MAIL "To: [e-mail]\n"; 
print MAIL "From: [e-mail]\n"; 
print MAIL "Subject: form stuff\n"; 
 
print MAIL "name: ", $query->param(name), "\n"; 
print MAIL "subject: ", $query->param(subject), "\n"; 
print MAIL "email: ", $query->param(emailaddy), "\n"; 
print MAIL "message: ", $query->param(message), "\n"; 

You aren't ending your header with a blank line, so what you think is in the body is still in the header, and hence could be used for spam! Also, you have an "@" inside a double-quoted string, and you're using barewords for "name" and "subject", etc, so "use strict" will be all over your ass for both of those, and rightfully so.

Maybe you should just concede at this point.

-- Randal L. Schwartz, Perl hacker