Question

I hope I’m missing something pretty basic here but: An empty form is getting submitted randomly, sometimes 3-8 times a day, then none for a few days and so on.

The empty submits always email with the subject as “[Website Contact Form].” Even though there is no validation in my php, in the html code the subject is chosen from a drop-down menu with the default as “General Enquiry.” Notice in the php code below, there is no way for a human to submit an empty form with the above subject line, that is, it would always be “[Website Contact Form]General Enquiry” if I press submit without entering anything.

I have contact.html call this contact.php file:

<?
   $email = '[e-mail]';
   $mailadd = $_POST['email'];
   $headers = 'From: ' . $_POST['email'] . "\r\n";
   $name = $_POST['name'];
   $subject = '[Website Contact Form] ' . $_POST['subject'];
   $message = 'Message sent from: ' . $name . '. Email: ' . $mailadd . '. Organization: ' . $_POST['company'] . '. Phone: ' . $_POST['phone'] . '. ';
   $message .= 'Message: ';
   $message .= $_POST['message'];

   if (mail($email,$subject,$message, $headers)) {
    echo "<p>Thank You! We'll get back to you shortly.</p>";
   }
   else {
    echo "<p>Error...</p>";
   }
?>

I use this code for many websites, but have never encountered this issue. Is there something so obviously wrong with this code that I’m missing? Any help would be greatly appreciated!

Answer 1

I suspect that you may not be checking that these variables are set before you send the email. Someone requesting contact.php directly (without any form data) may produce the results you have described. If this is the case, the following code should work like a charm:

<?php
    if (isset($_POST['submit']) {
        // form code
    }
    else {
        // The form was not submitted, do nothing
    }
?>

Even if that’s not that case, such a simple check is always good practice.

Furthermore, you should always validate any user input just as a good habit. You don’t want your server flooding your inbox with emails. I suggest using regexs to validate the input provided and possibly use a captcha service (such as ReCaptcha).