Would this PHP Code Work?

Question

Hello there,
I'm currently designing a website fot myself but need a page
where people can send me feedback about the site or leave any
questions. Now I've used some PHP to accomplish this but I shalln't
be buying web hosting, etc until I've completely finished the site
- therefore I am unable to test the the from to see if it works.
The following is what I have done:
1:) Created a HTML page with the following inserted into the
body of the page:
<form method="post" action="sendmail.php">
Email: <input name="email" type="text" /><br />
Message:<br />
<textarea name="message" rows="15" cols="40">
</textarea><br />
<input type="submit" />
</form>
2:) I then created a PHP page with only the following code in
the PHP file:
<?
$email = $_REQUEST['email'] ;
$message = $_REQUEST['message'] ;
mail( "[email protected]", "Feedback Form Results",
$message, "From: $email" );
header( "Location:
http://www.example.com/thankyou.html"
?>
I would be very grateful if somebody could perhaps test this
or could tell me that it will indeed work - or as the case maybe,
it won't.
All the best,
Kristopher (UK).

Answer 1

Coxdabd wrote:
> I would be very grateful if somebody could perhaps test
this or could tell me
> that it will indeed work - or as the case maybe, it
won't.
Yes, it will work. It will also turn your website into a
wonderful spam
relay. You should never trust user input without checking its
content.
Validating user input isn't something that can be covered in
a simple
forum post, but one thing that would make your script
(marginally) safer
is to remove "From: $email" from the mail() function. As
currently
scripted, it's a wide open security gap.
David Powers, Adobe Community Expert
Author, "The Essential Guide to Dreamweaver CS3" (friends of
ED)
Author, "PHP Solutions" (friends of ED)
http://foundationphp.com/