forked from dapphp/securimage
-
Notifications
You must be signed in to change notification settings - Fork 0
/
example_form.php
246 lines (199 loc) · 9.29 KB
/
example_form.php
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
<?php
error_reporting(E_ALL);
ini_set('display_errors', 1);
require_once __DIR__ . '/securimage.php';
// if not using Composer, must require these before using session
require_once __DIR__ . '/CaptchaObject.php';
require_once __DIR__ . '/StorageAdapter/AdapterInterface.php';
session_start(); // this MUST be called prior to any output including whitespaces and line breaks!
$GLOBALS['DEBUG_MODE'] = 1;
// CHANGE TO 0 TO TURN OFF DEBUG MODE
// IN DEBUG MODE, ONLY THE CAPTCHA CODE IS VALIDATED, AND NO EMAIL IS SENT
$GLOBALS['ct_recipient'] = '[email protected]'; // Change to your email address! Make sure DEBUG_MODE above is 0 for mail to send!
$GLOBALS['ct_msg_subject'] = 'Securimage Test Contact Form';
?>
<!DOCTYPE html>
<html>
<head>
<meta charset="utf-8">
<meta http-equiv="Content-type" content="text/html;charset=UTF-8">
<title>Securimage Example Form</title>
<link rel="stylesheet" href="securimage.css" media="screen">
<style type="text/css">
<!--
div.error { display: block; color: #f00; font-weight: bold; font-size: 1.2em; }
span.error { display: block; color: #f00; font-style: italic; }
.success { color: #00f; font-weight: bold; font-size: 1.2em; }
form label { display: block; font-weight: bold; }
fieldset { width: 90%; }
legend { font-size: 24px; }
.note { font-size: 18px;
-->
</style>
</head>
<body>
<fieldset>
<legend>Example Form</legend>
<p class="note">
This is an example PHP form that processes user information, checks for errors, and validates the captcha code.<br />
This example form also demonstrates how to submit a form to itself to display error messages.
</p>
<?php
process_si_contact_form(); // Process the form, if it was submitted
if (isset($_SESSION['ctform']['error']) && $_SESSION['ctform']['error'] == true): /* The last form submission had 1 or more errors */ ?>
<div class="error">There was a problem with your submission. Errors are displayed below in red.</div><br>
<?php elseif (isset($_SESSION['ctform']['success']) && $_SESSION['ctform']['success'] == true): /* form was processed successfully */ ?>
<div class="success">The captcha was correct and the message has been sent! The captcha was solved in <?php echo $_SESSION['ctform']['timetosolve'] ?> seconds.</div><br />
<?php endif; ?>
<form method="post" action="<?= htmlspecialchars($_SERVER['REQUEST_URI'] . ($_SERVER['QUERY_STRING'] ?? '')) ?>" id="contact_form">
<input type="hidden" name="do" value="contact">
<p>
<label for="ct_name">Name*:</label>
<?php echo @$_SESSION['ctform']['name_error'] ?>
<input type="text" id="ct_name" name="ct_name" size="35" value="<?= htmlspecialchars($_SESSION['ctform']['ct_name'] ?? '') ?>">
</p>
<p>
<label for="ct_email">Email*:</label>
<?php echo @$_SESSION['ctform']['email_error'] ?>
<input type="text" id="ct_email" name="ct_email" size="35" value="<?= htmlspecialchars($_SESSION['ctform']['ct_email'] ?? '') ?>">
</p>
<p>
<label for="ct_URL">URL:</label>
<?php echo @$_SESSION['ctform']['URL_error'] ?>
<input type="text" id="ct_URL" name="ct_URL" size="35" value="<?= htmlspecialchars($_SESSION['ctform']['ct_URL'] ?? '') ?>">
</p>
<p>
<label for="ct_message">Message*:</label>
<?= $_SESSION['ctform']['message_error'] ?? '' ?>
<textarea id="ct_message" name="ct_message" rows="12" cols="60"><?= htmlspecialchars($_SESSION['ctform']['ct_message'] ?? '') ?></textarea>
</p>
<div>
<?php
// show captcha HTML using Securimage::getCaptchaHtml()
$options = array();
$options['input_name'] = 'ct_captcha'; // change name of input element for form post
if (!empty($_SESSION['ctform']['captcha_error'])) {
// error html to show in captcha output
$options['error_html'] = $_SESSION['ctform']['captcha_error'];
}
echo "<div id='captcha_container_1'>\n";
echo Securimage::getCaptchaHtml($options);
echo "\n</div>\n";
/*
// To render some or all captcha components individually
$options['input_name'] = 'ct_captcha_2';
$options['image_id'] = 'ct_captcha_2';
$options['input_id'] = 'ct_captcha_2';
$options['namespace'] = 'captcha2';
echo "<br>\n<div id='captcha_container_2'>\n";
echo Securimage::getCaptchaHtml($options, Securimage::HTML_IMG);
echo Securimage::getCaptchaHtml($options, Securimage::HTML_ICON_REFRESH);
echo Securimage::getCaptchaHtml($options, Securimage::HTML_AUDIO);
echo '<div style="clear: both"></div>';
echo Securimage::getCaptchaHtml($options, Securimage::HTML_INPUT_LABEL);
echo Securimage::getCaptchaHtml($options, Securimage::HTML_INPUT);
echo "\n</div>";
*/
?>
</div>
<p>
<br>
<input type="submit" value="Submit Message">
</p>
</form>
</fieldset>
</body>
</html>
<?php
// The form processor PHP code
function process_si_contact_form()
{
$_SESSION['ctform'] = array(); // re-initialize the form session data
if ($_SERVER['REQUEST_METHOD'] == 'POST' && @$_POST['do'] == 'contact') {
// if the form has been submitted
foreach($_POST as $key => $value) {
if (!is_array($key)) {
// sanitize the input data
if ($key != 'ct_message') $value = strip_tags($value);
$_POST[$key] = htmlspecialchars(stripslashes(trim($value)));
}
}
$name = @$_POST['ct_name']; // name from the form
$email = @$_POST['ct_email']; // email from the form
$URL = @$_POST['ct_URL']; // url from the form
$message = @$_POST['ct_message']; // the message from the form
$captcha = @$_POST['ct_captcha']; // the user's entry for the captcha code
$capId = @$_POST['captcha_id']; // the captcha ID to check
$name = substr($name, 0, 64); // limit name to 64 characters
$errors = array(); // initialize empty error array
if (isset($GLOBALS['DEBUG_MODE']) && $GLOBALS['DEBUG_MODE'] == false) {
// only check for errors if the form is not in debug mode
if (strlen($name) < 3) {
// name too short, add error
$errors['name_error'] = 'Your name is required';
}
if (strlen($email) == 0) {
// no email address given
$errors['email_error'] = 'Email address is required';
} else if ( !preg_match('/^(?:[\w\d-]+\.?)+@(?:(?:[\w\d]\-?)+\.)+\w{2,63}$/i', $email)) {
// invalid email format
$errors['email_error'] = 'Email address entered is invalid';
}
if (strlen($message) < 20) {
// message length too short
$errors['message_error'] = 'Your message must be longer than 20 characters';
}
}
// Only try to validate the captcha if the form has no errors
// This is especially important for ajax calls
if (sizeof($errors) == 0) {
$securimage = new Securimage();
/**
* Validate the user input ($captcha) against the submitted captcha ID ($capId).
* The third parameter (true) tells Securimage to delete the data for this
* captcha ID even if the guess was incorrect. Since the form POSTs to itself
* and reloads the page, the old ID is never used again and no longer needed.
*
* $securimage->check() returns TRUE if the code is correct, or FALSE if it was
* incorrect. Only let the form pass if check() returns TRUE.
*
*/
if ($securimage->check($captcha, $capId, true) == false) {
$errors['captcha_error'] = 'Incorrect security code entered<br />';
}
}
if (sizeof($errors) == 0) {
// no errors, send the form
$time = date('r');
$message = "A message was submitted from the contact form. The following information was provided.<br /><br />"
. "<em>Name: $name</em><br />"
. "<em>Email: $email</em><br />"
. "<em>URL: $URL</em><br />"
. "<em>Message:</em><br />"
. "<pre>$message</pre>"
. "<br /><br /><em>IP Address:</em> {$_SERVER['REMOTE_ADDR']}<br />"
. "<em>Time:</em> $time<br />"
. "<em>Browser:</em> " . htmlspecialchars($_SERVER['HTTP_USER_AGENT']) . "<br />";
$message = wordwrap($message, 70);
if (isset($GLOBALS['DEBUG_MODE']) && $GLOBALS['DEBUG_MODE'] == false) {
// send the message with mail()
mail($GLOBALS['ct_recipient'], $GLOBALS['ct_msg_subject'], $message, "From: {$GLOBALS['ct_recipient']}\r\nReply-To: {$email}\r\nContent-type: text/html; charset=UTF-8\r\nMIME-Version: 1.0");
}
$_SESSION['ctform']['timetosolve'] = $securimage->getTimeToSolve();
$_SESSION['ctform']['error'] = false; // no error with form
$_SESSION['ctform']['success'] = true; // message sent
} else {
// save the entries, this is to re-populate the form
$_SESSION['ctform']['ct_name'] = $name; // save name from the form submission
$_SESSION['ctform']['ct_email'] = $email; // save email
$_SESSION['ctform']['ct_URL'] = $URL; // save URL
$_SESSION['ctform']['ct_message'] = $message; // save message
foreach($errors as $key => $error) {
// set up error messages to display with each field
$_SESSION['ctform'][$key] = "<span class=\"error\">$error</span>";
}
$_SESSION['ctform']['error'] = true; // set error floag
}
} // POST
}
$_SESSION['ctform']['success'] = false; // clear success value after running