PHP: contact form says "something missing" but it's not

Question

The content is essentially identical to a working Contact
Form but obviously
I have an error somewhere. Could somebody please take a look?
http://lerosmarina.gr/contact.php
calls jomail.php - code, comments removed:
<?php
$locationroot = "Location:
http://www.lerosmarina.gr/";
$toAddress = "[email protected]";
$fromAddress = "From: [email protected]";
if (is_array($val)) {
foreach ($val as $item) {
isSuspect($item, $pattern, $suspect);
else {
if (preg_match($pattern, $val)) {
$suspect = true;
if (!isset($_REQUEST['email']))
header( $locationroot."contact_us.php" );
elseif (empty($surname) || empty($firstname) ||
empty($company)
||empty($phone) || empty($email))
header( $locationroot."missing.php" );
else
$suspect = false;
$pattern = '/Content-Type:|Bcc:|Cc:/i';
isSuspect($_POST, $pattern, $suspect);
if (!empty($_POST['email'])) {
$checkEmail = '/^[^@]+@[^\s\r\n\'";,@%]+$/';
if (!preg_match($checkEmail, $_POST['email'])) {
$suspect = true;
if (!$suspect) {
$subject = "Feedback from ".$originating_site." Web Site
about
".$mailsubject;
$mailcontent = "Originating Site: ".$originating_site."\n";
$mailcontent .= "Mail Subject: ".$mailsubject."\n";
$mailcontent .= "Customer First Name: ".$firstname."\n";
$mailcontent .= "Customer Surname: ".$surname."\n";
$mailcontent .= "Customer EMail Address: ".$email."\n";
$mailcontent .= "Customer Telephone Number: ".$phone."\n";
$mailcontent .= "Customer Comments: ".$msgbody."\n";
$mailcontent .= "Customer referer:
".getenv('HTTP_REFERER')."\n";
$mailcontent .= "Customer address:
".getenv('REMOTE_ADDR')."\n";
$mailcontent .= "Customer host:
".getenv('REMOTE_HOST')."\n";
mail($toAddress,stripslashes($subject),stripslashes($mailcontent),stripslashes($fromAddre ss));
header( $locationroot."thankyou.php" );
else
$subject = "Mail Injection Hack Attempted at
".$originating_site;
$mailcontent = "Originating Site: ".$originating_site."\n";
$mailcontent .= "Customer referer:
".getenv('HTTP_REFERER')."\n";
$mailcontent .= "Customer address:
".getenv('REMOTE_ADDR')."\n";
$mailcontent .= "Customer host:
".getenv('REMOTE_HOST')."\n";
mail($toAddress,stripslashes($subject),stripslashes($mailcontent),stripslashes($fromAddre ss));
header( $locationroot."thankyou.php" );
?><?php
$locationroot = "Location:
http://www.lerosmarina.gr/";
if (!isset($_REQUEST['email']))
header( $locationroot."contact.php" );
elseif (empty($surname) || empty($firstname) ||
empty($company)
||empty($phone) || empty($email))
header( $locationroot."missing.php" );
else
$toAddress = "[email protected]";
$fromAddress = "From: [email protected]";
$subject = "Feedback from ".$originating_site." Web Site
about
".$mailsubject;
$mailcontent = "Originating Site: ".$originating_site."\n";
$mailcontent .= "Mail Subject: ".$mailsubject."\n";
$mailcontent .= "Customer First Name: ".$firstname."\n";
$mailcontent .= "Customer Surname: ".$surname."\n";
$mailcontent .= "Customer EMail Address: ".$email."\n";
$mailcontent .= "Customer Telephone Number: ".$phone."\n";
$mailcontent .= "Customer Comments: ".$msgbody."\n";
$mailcontent .= "Customer referer:
".getenv('HTTP_REFERER')."\n";
$mailcontent .= "Customer address:
".getenv('REMOTE_ADDR')."\n";
$mailcontent .= "Customer host:
".getenv('REMOTE_HOST')."\n";
mail($toAddress,stripslashes($subject),stripslashes($mailcontent),stripslashes($fromAddre ss));
header( $locationroot."thankyou.php" );
$suspect = false;
$pattern = '/Content-Type:|Bcc:|Cc:/i';
function isSuspect($val, $pattern, &$suspect) {
if (is_array($val)) {
foreach ($val as $item) {
isSuspect($item, $pattern, $suspect);
else {
if (preg_match($pattern, $val)) {
$suspect = true;
isSuspect($_POST, $pattern, $suspect);
if (!empty($_POST['email'])) {
$checkEmail = '/^[^@]+@[^\s\r\n\'";,@%]+$/';
if (!preg_match($checkEmail, $_POST['email'])) {
$suspect = true;
if (!$suspect) {
if (!$suspect) {
else {
?>

Answer 1

Thanks Gareth, I'll try that out
Jo
"gareth" <support@nospam_phploginsuite.co.uk> wrote in
message
news:es4740$2u4$[email protected]..
> The problem is that it looks like an old script and
register_globals is
> turned off on your server (as it should be).
>
> With the following:
>
> elseif (empty($surname) || empty($firstname) ||
empty($company)
> ||empty($phone) || empty($email))
>
> Its referencing submitted values by their name only,
which you used to be
> able to do, but was very insecure. Now you have to tell
PHP exactly where
> the data comes from, so the above should be:
>
> elseif (empty($_POST['surname']) ||
empty($_POST['firstname']) ||
> empty($_POST['company'])
> ||empty($_POST['phone']) || empty($_POST['email']))
>
> This should pass the missing data check now, however,
you`ll need to go
> through all your code, and anywhere it references a
value from the form
> change from $variable_name to $_POST['variable_name']
>
> Should work as intended then.
>
> --
> Gareth
>
http://www.phploginsuite.co.uk/
> PHP Login Suite V2 - 34 Server Behaviors to build a
complete Login system.
>