[d*d]

I have a contact page on my site which has a form with the usual fields for name email address phone number and a text box to add comments, over the weekend I have had seven emails sent from my site which look as though code is bieng entered into the comments box, the code to me is completely illegible :-

Content-Type: multipart/mixed; boundary="===============0493523298=="
MIME-Version: 1.0
Subject: d99191ca

This is a multi-part message in MIME format.

--===============0493523298==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit

iadjih
--===============0493523298==--

does this mean anything to anyone????

[Brown]

yes, spammers are trying to use your contact form to send spam email. do you have any validation on your form?

[aspiramedia]

I have this too. 100 emails a day! GRRRR! Anyone know enough php to stop this happening?

[pgo]

Originally Posted by aspiramedia

I have this too. 100 emails a day! GRRRR! Anyone know enough php to stop this happening?

Good God man! Just edit your mailing script and use "if" statements on the different inputs. If there's no email address entered, send them back. If there's no name entered, send them back. If there's no subject entered, send them back. And so on.

If I don't know PHP and I was able to do it, anyone can.

[gray]

http://www.designateonline.com/forum...pic.php?t=8676

[d*d]

Originally Posted by Brown

yes, spammers are trying to use your contact form to send spam email. do you have any validation on your form?

only basic stuff, to make sure the email adress is an email adresss and the phone number is a number but the comments box is anything goes at the moment

[Dusteh]

Am I correct in thinking this attack only works if any part of your form enters info into the sender/bc/cc/title areas of an email?

If you hardcode these or leave them blank and just allow info into the emails content then this will not be a problem?

[Prole]

i had this too. they automatically fill in every contact form line with an email address, so i'm guessing if you make sure one of them is a phone number then it should prevent the spam.

[Rakan]

I personally don't know PHP but I use ASP, and the way I avoid code injection is by encoding all inputs... i.e. Server.HTMLEncode(INPUTTED_DATA_VARIABLE_GOES_HERE )

I'm pretty sure PHP has something like this...