Yet another awesome service from google. reCaptcha. More on that later. But firstly, sending from the right address.
Helping out a friend at her new(ish) job and their contact form simply sucked. Suppose it takes a bit of a background in both PHP web coding and more so in understanding Mail protocols than anything else.
The first thing people really need to get out of the habit is trying to send emails as the person who wishes to contact you. Take in this small example;
<?php
$to = 'contact@mydomain.com';
$subject = 'Website Contact Form';
$message = $_POST['formMessage'];
$headers = 'From: ' . $_POST['formEmailAddress'] . "\r\n";
mail($to, $subject, $message, $headers);
?>
Without getting hooked up on using raw entries from $_POST, basically the above code will take your contact details and attempt to send it to yourself. You write into the headers that this email is coming from whatever address the user entered when filling in the form.
THAT'S A BIG NO NO. More and more mail servers today (including your own, which is where some of the issue comes) checks the IP and/or domain name of where an email is being sent from, in this case it's your webserver, and looks up that domain to see if that domain or IP address is allowed to pretend to be sending mail. I promise no one has added in your domain details to allow to send email as them. Certainly not the bigger dogs like Bigpond, Optus etc.
This is just one method that checks mail servers use today to check the authenticity of mail getting into people's boxes. Otherwise you can basically be sending mail out as Google or even PayPal.
(more…)
Categories: PHP | Programming