Hi Lena - so I started getting a lot of spam again despite all the additional protection I learned from your article - what am I doing wrong?
CONTACT FORM PAGE:
<?php
session_start();
if (!isset($_SESSION['csrf_token'])) {
$_SESSION['csrf_token'] = bin2hex(random_bytes(32));
}
?>
HEAD
THE FORM:
<form id="contactForm" method="POST" action="process_form3.php">
<!-- Honeypot -->
<div style="display:none;">
<label for="website">Website</label>
<input type="text" name="website" id="website" autocomplete="off">
</div>
<!-- Hidden CSRF Token -->
<input type="hidden" name="csrf_token" value="<?php echo htmlspecialchars($_SESSION['csrf_token']); ?>">
<input type="hidden" name="form_load_time" id="form_load_time">
<input type="text" name="name" id="email" required placeholder="TYPE YOUR NAME">
<input type="text" name="email" id="text" required placeholder="TYPE YOUR EMAIL">
<textarea name="message" id="textarea"required placeholder="YOUR MESSAGE"></textarea>
<input type="submit" id="submit" name="submit" value="Submit">
<div id="formErrors"></div>
</form>
</div>
</div>
<div class="thank_you_message" style="display:none; text-align:center;">
<p class="thank_you">Thanks! Message Sent.</p>
<a href="#" id="returnToForm" class="returnToForm">Return to Form</a>
</div>
THE SCRIPT:
<script>
// Load time for spam timing test
const formLoadTime = Date.now();
document.getElementById('form_load_time').value = formLoadTime;
// Fetch CSRF token
fetch('get_csrf.php')
.then(res => res.json())
.then(data => {
document.getElementById('csrf_token').value = data.csrf_token;
});
// Submit form with protections
const form = document.getElementById('contactForm');
form.addEventListener('submit', function(e) {
e.preventDefault();
const formData = new FormData(form);
const formContainer = document.querySelector('.form_container');
const thankYou = document.querySelector('.thank_you_message');
const errors = document.getElementById('formErrors');
fetch(form.action, {
method: 'POST',
body: formData
})
.then(res => res.text())
.then(response => {
if (response.trim().toLowerCase() === "success") {
formContainer.style.transition = "opacity 0.7s";
formContainer.style.opacity = 0;
setTimeout(() => {
formContainer.style.display = "none";
thankYou.style.display = "block";
thankYou.style.opacity = 0;
thankYou.style.transition = "opacity 0.7s";
setTimeout(() => {
thankYou.style.opacity = 1;
}, 10);
}, 700);
} else {
errors.textContent = response;
}
})
.catch(() => {
errors.textContent = "An error occurred. Please try again.";
});
});
// Return to form
const returnBtn = document.getElementById('returnToForm');
returnBtn.addEventListener('click', function(e) {
e.preventDefault();
const form = document.getElementById('contactForm');
const formContainer = document.querySelector('.form_container');
const thankYou = document.querySelector('.thank_you_message');
thankYou.style.transition = "opacity 0.7s";
thankYou.style.opacity = 0;
setTimeout(() => {
thankYou.style.display = "none";
form.reset();
formContainer.style.display = "block";
formContainer.style.opacity = 0;
formContainer.style.transition = "opacity 0.7s";
setTimeout(() => {
formContainer.style.opacity = 1;
}, 10);
}, 700);
});
</script>
PROCESS_FORM3.PHP:
<?php
use PHPMailer\PHPMailer\PHPMailer;
use PHPMailer\PHPMailer\Exception;
require 'PHPMailer/src/Exception.php';
require 'PHPMailer/src/PHPMailer.php';
require 'PHPMailer/src/SMTP.php';
session_start();
if ($_SERVER["REQUEST_METHOD"] === "POST") {
// CSRF protection
if (!hash_equals($_SESSION['csrf_token'], $_POST['csrf_token'])) {
http_response_code(403);
echo 'Invalid CSRF token.';
exit;
}
// Honeytrap spam filter
if (!empty($_POST['website'])) {
http_response_code(400);
echo 'Spam detected.';
exit;
}
// Sanitize inputs
$name = htmlspecialchars(trim($_POST["name"]));
$email = filter_var(trim($_POST["email"]), FILTER_VALIDATE_EMAIL);
$message = htmlspecialchars(trim($_POST["message"]));
if (!$email) {
http_response_code(400);
echo 'Invalid email.';
exit;
}
// Setup mailer
$mail = new PHPMailer(true);
try {
// SMTP Settings (Bluehost)
$mail->isSMTP();
$mail->Host = 'mail.pitchlab.net'; // or use 'smtp.bluehost.com'
$mail->SMTPAuth = true;
$mail->Username = 'inquiries@pitchlab.net'; // your email
$mail->Password = '######; // use App Password if 2FA is on
$mail->SMTPSecure = 'tls';
$mail->Port = 587;
// Email to YOU (the site owner)
$mail->setFrom('inquiries@pitchlab.net', 'Pitchlab ');
$mail->addAddress('inquiries@pitchlab.net');
$mail->Subject = 'Pitchlab Inquiry!';
$mail->Body = "From: $name <$email>\n\n$message";
$mail->send();
// Auto-Responder to the User
$mail->clearAddresses();
$mail->addAddress($email);
$mail->Subject = 'Thanks for contacting Pitchlab';
$mail->Body = "Hi $name,\n\nThanks for reaching out. Your message just landed in the lab, we will get back to you ASAP!
The Pitchlab Team
$mail->send();
echo "Success";
} catch (Exception $e) {
http_response_code(500);
echo "Mailer Error: " . $mail->ErrorInfo;
}
}
?>
2 Correct answers
Id like it to operate more like this with a message received below but Im not sure how secure it is to have the PHP be on the same page including the email in the code:
54
Replies
AdChoices