Hi, can someone let me know if this script looks secure. I have tried to take as many security measures as possible (within my coding ability):
<?php
// define variables and set to empty values
$nameErr = $telephoneErr = $emailErr = $detailsErr = $msgStatus = "";
$name = $telephone = $email = $details = "";
// if the button has been pressed
if ($_SERVER["REQUEST_METHOD"] == "POST") {
if (empty($_POST["name"])) {
$nameErr = "Name is required";
} else {
$name = test_input($_POST["name"]);
// check if name only contains letters and whitespace
if (!preg_match("/^[a-zA-Z ]*$/",$name)) {
$nameErr = "Only letters and white space allowed";
}
}
if (empty($_POST["telephone"])) {
$telephoneErr = "Telephone is required";
} else {
$telephone = test_input($_POST["telephone"]);
}
if (empty($_POST["email"])) {
$emailErr = "Email is required";
} else {
$email = test_input($_POST["email"]);
// check if e-mail address is well-formed
if (!filter_var($email, FILTER_VALIDATE_EMAIL)) {
$emailErr = "Invalid email format";
}
}
if (empty($_POST["details"])) {
$detailsErr = "Details is required";
} else {
$details = test_input($_POST["details"]);
}
//there are no errors so we are ok to print the submitted post
$to = "mymainemail.com";
$subject = "You have a new message from your website";
$message = "$name <br> $telephone <br> $email <br> $details";
// Always set content-type when sending HTML email
$headers = "MIME-Version: 1.0" . "\r\n";
$headers .= "Content-type:text/html;charset=UTF-8" . "\r\n";
// More headers
$headers .= 'From: <webmaster@myemail.co.uk>' . "\r\n";
if (!empty($nameErr) && !empty($telephoneErr) && !empty($emailErr) && !empty($detailsErr)) {
$msgStatus = "Failed to send";
} else {
mail($to,$subject,$message,$headers);
$msgStatus = "<span style='color: green;'>Successful</span>";
}
}
function test_input($data) {
$data = trim($data);
$data = stripslashes($data);
$data = htmlspecialchars($data);
return $data;
}
?>
<form method="post" action="<?php echo htmlspecialchars($_SERVER["PHP_SELF"]); ?>">
<span class="title">24 hour free callback request</span>
<div class="form-group">
<label for="name">Name *</label>
<input type="text" class="form-control" name="name">
<span class="error"><?php echo $nameErr; ?></span>
</div>
<div class="form-group">
<label for="telephone">Telephone</label>
<input type="text" class="form-control" name="telephone">
<span class="error"><?php echo $telephoneErr; ?></span>
</div>
<div class="form-group">
<label for="email">Email *</label>
<input type="email" class="form-control" name="email">
<span class="error"><?php echo $emailErr; ?></span>
</div>
<div class="form-group">
<label>Looking For:</label>
<div class="checkbox">
<label><input type="checkbox" value="Insect Control" name="service">Insect Control</label>
</div>
<div class="checkbox">
<label><input type="checkbox" value="Rodents & Vermin" name="">Rodents & Vermin</label>
</div>
<div class="checkbox disabled">
<label><input type="checkbox" value="General Enquiry" name="">General Enquiry</label>
</div>
</div>
<div class="form-group">
<label for="details">Further Details: *</label>
<textarea class="form-control" rows="5" name="details"></textarea>
<span class="error"><?php echo $detailsErr; ?></span>
</div>
<div class="form-group">
<button type="submit" class="btn btn-cta">Contact Us</button><br>
<span class="error"><?php echo $msgStatus; ?></span>
</div>
</form>
