Does contact us page requires protection?
- Thread starter Mutikasa
- Start date
MrBlue
Senior Member
- Dec 18, 2009
- 975
- 695
Best practices suggest one should always sanitize input data. Including a captcha as well can help deter automated form submission.
Sanitizing an input field in PHP using filters
More on sanitize filters here:
Escaping input prior to MySQL insert in PHP
Sanitizing an input field in PHP using filters
Code:
<?php
$filtered_string = filter_var(trim($_POST['input']), FILTER_SANITIZE_STRING);
?>More on sanitize filters here:
Code:
https://secure.php.net/manual/en/filter.filters.sanitize.phpEscaping input prior to MySQL insert in PHP
Code:
<?php
$db->mysqli->real_escape_string($filtered_string);
?>
Last edited:
Not really well. The only thing that's really needed is prevention from injections : (
And here's a good news. If you're already using PHP extension PDO to communicate with DB, then you're okay. Else, check this little tutorial out here. I explain how PDO works differently than PDO and precents injectoins.
webdevtown c0 m Search for 'PDO'.
And here's a good news. If you're already using PHP extension PDO to communicate with DB, then you're okay. Else, check this little tutorial out here. I explain how PDO works differently than PDO and precents injectoins.
webdevtown c0 m Search for 'PDO'.
- Jun 30, 2014
- 13,739
- 5,216
Depends how secure you really want to be. Most of the time SQL injection and xss protection will do but email forms do have some other nasties to look out for...
"Email injection is a type of injection attack that hits the PHP built-in mail function. It allows the malicious attacker to inject any of the mail header fields like, BCC , CC, Subject, etc., which allows the hacker to send out spam from their victims? mail server through their victims? contact form. For this reason, this attack is called Email Injection, or mail form spamming."
"Email injection is a type of injection attack that hits the PHP built-in mail function. It allows the malicious attacker to inject any of the mail header fields like, BCC , CC, Subject, etc., which allows the hacker to send out spam from their victims? mail server through their victims? contact form. For this reason, this attack is called Email Injection, or mail form spamming."
Anything that connects to the database requires protection. Depending on how your mysql connections are made, you may already be safe from sql injections though. Additionally, it is critical to add a captcha to your contact form, because it is a key page for ddos attack. It consumes system resources so send a mail as well as the fact that a ddos attack could get your IP blacklisted on spamhaus if you are sending thousands upon thousands of spam mails.