Защита почтового скрипта от взлома
Есть скрипт для отсылки почты из формы на сайте (приведен ниже). Я вовсе не асс программирования и прошу помощи: посоветуйте, что сделать в плане безопасности (от взлома сайта). Действия против спамеров почитаю в предыдущем посте:)). Спасибо.
<!–form, make one as pleased with own fields and variables below…. –>
<INPUT TYPE=TEXT NAME=”name” SIZE=15> name <BR><BR>
<INPUT TYPE=TEXT NAME=”adress” SIZE=15> adress<BR><BR>
<INPUT TYPE=TEXT NAME=”email” SIZE=15> email adress<BR><BR>
additional text<br>
<TEXTAREA NAME=”textfield” WRAP=”physical” COLS=”25″ ROWS=”6″></TEXTAREA><BR><BR>
<!–COPY below to your form (or use this one)–>
<!–params below must be used –>
<INPUT TYPE=HIDDEN NAME=F_FROM VALUE=”Name Of Website”> <!–from- line for email –>
<INPUT TYPE=HIDDEN NAME=F_TO VALUE=”yourname@domain.com”> <!–to- line for email: your/owner website adress –>
<INPUT TYPE=HIDDEN NAME=F_SUBJECT VALUE=”This is the subject”> <!–subject- line for email –>
<INPUT TYPE=HIDDEN NAME=F_TEMPLATE VALUE=”template.txt”> <!–template file location –>
<INPUT TYPE=HIDDEN NAME=F_TEMPLATE2 VALUE=”template2.txt”> <!–OPTIONAL: (otherwise leave empty) template2 file location (return sender (acknowledgement) only: works when the sender has filled in his email adress )–>
<INPUT TYPE=HIDDEN NAME=F_SENT VALUE=”sent_ok.html”> <!–form to go to after successfully sending the form–>
<INPUT TYPE=HIDDEN NAME=F_NOTSENT VALUE=”sent_notok.html”> <!–form to go to after errors with sending the form–>
<!–END-COPY –>
<INPUT TYPE=SUBMIT VALUE=” send it “>
Собственно сам скрипт:
<?php
function file2go2($url){ print “<html>\n<head>\n<meta http-equiv=\”refresh\” content=\”0;URL=$url\”>\n</head>\n</html>
if(!@fopen($F_TEMPLATE, “r”)) file2go2($F_NOTSENT);
else $arr_t1 = @file( $F_TEMPLATE ); $nr_mail = 1;
if (! $F_TEMPLATE2 == “” && !@fopen($F_TEMPLATE2, “r”)) file2go2($F_NOTSENT);
if (! $F_TEMPLATE2 == “” && @fopen($F_TEMPLATE2, “r”)) $arr_t2 = @file( $F_TEMPLATE2 ); $nr_mail = 2;
$domail = 1;
while ($domail <= $nr_mail):
if ($domail == 1) $var2use = $arr_t1; else $var2use = $arr_t2;
for ($index = 0; $index < count($var2use); $index++)
{
$pattern = ereg(”\{\{[A-z0-9_]*\}\}”, $var2use[$index]);
if ($pattern)
{
$line = ereg_replace(”\{\{”,”$”,$var2use[$index]
$line = ereg_replace(”\}\}”,”",$line);
}
else
{
$line = $var2use[$index];
}
$line = addslashes($line) . “<br>”;
eval( “\$line = \”$line\”;” );
if ($index == 0 && $domail == 1) $linetot1 = $line;
elseif ($index > 0 && $domail == 1) $linetot1 .= $line;
if ($index == 0 && $domail == 2) $linetot2 = $line;
elseif ($index > 0 && $domail == 2) $linetot2 .= $line;
}
++$domail;
endwhile;
//the next line will email the template to $F_TO of your form (normally yourself c.q. the owner of website
$mailit1 = @mail($F_TO, $F_SUBJECT, $linetot1, “From: $F_FROM \nMime-Version: 1.0\nContent-Type: text/html; charset=ISO-8859-1\nContent-Transfer-Enc
//the next line will email the sender: change the $email to the variable of your form (the email adress of the visitor)
//only do this when you want 2 templates emailed.
if ($nr_mail == 2) $mailit2 = @mail($email, $F_SUBJECT, $linetot2, “From: $F_FROM\nMime-Version: 1.0\nContent-Type: text/html; charset=ISO-8859-1\nContent-Transfer-Enc
if ($mailit1 = true) $sent = 1;
else $sent = 0;
if ($mailit2 = true) $sent = 2;
else $sent = 0;
if ($nr_mail == 1 && $sent == 1) file2go2($F_SENT);
if ($nr_mail == 1 && $sent == 0) file2go2($F_NOTSENT);
if ($nr_mail == 2 && $sent == 2) file2go2($F_SENT);
if ($nr_mail == 2 && $sent == 0) file2go2($F_NOTSENT);
?>
И пример файла-шаблона template.txt (аналогичный template2.txt):
This is template 1 (standard) example:
From : {{F_FROM}}
To : {{F_TO}}
Subject : {{F_SUBJECT}}
Your name is {{name}} Your adress is {{adress}} You email adress is {{email}} The additional text you entered on our website: ————————————– (just an example that it also supports HTML syntax)…..
{{textfield}}
click <a href=”http://www.disney.com”>here</a> to visit the disney site
Комментариев нет
Комментариев нет.
Извините, комментирование на данный момент закрыто.