我读到我不应该这样做,因为它不安全。但是我该怎么做呢? 编辑:这是-6ren">
gpt4 book ai didi

php - 传递表单变量的安全方式

转载 作者:行者123 更新时间:2023-12-02 05:05:03 25 4
gpt4 key购买 nike

我正在为我的 wordpress 主题构建一个联系表。我希望能够从后端输入接收者地址。目前我正在传递带有隐藏输入字段的变量。

<input type="text" class="hidden" name="receiver" value="<?php get_option('admin_email') ?>"/>

我读到我不应该这样做,因为它不安全。但是我该怎么做呢?

编辑:这是我的 process.php。我试图获取管理员电子邮件,但不知何故中断了它。

<?php if( isset($_POST) ){

//form validation vars
$formok = true;
$errors = array();

//sumbission data
$ipaddress = $_SERVER['REMOTE_ADDR'];
$date = date('d.m.Y');
$time = date('H:i');

//form data
$name = $_POST['name'];
$email = $_POST['email'];
$website = $_POST['website'];
$budget = $_POST['budget'];
$message = $_POST['message'];

$receiver = $_POST['receiver'];
$sender = get_option('admin_email');

if(empty($name)){
$formok = false;
$errors[] = "Sie haben keinen Namen angegeben.";
}

if(empty($email)){
$formok = false;
$errors[] = "Sie haben keine Emailadresse angegeben.";
//validate email address
}elseif(!filter_var($email, FILTER_VALIDATE_EMAIL)){
$formok = false;
$errors[] = "Sie haben keine gültige Emailadresse angegeben.";
}

if(empty($message)){
$formok = false;
$errors[] = "Das Nachrichtenfeld ist leer.";
}
elseif(strlen($message) < 20){
$formok = false;
$errors[] = "Ihre Nachricht muss mindestens 20 Zeichen enthalten.";
}

if($formok){
$headers = "From: {$email}" . "\r\n";
$headers .= 'Content-type: text/html; charset=UTF-8' . "\r\n";

$emailbody = "<p><strong>Name: </strong> {$name} </p>
<p><strong>Website: </strong> {$website} </p>
<p><strong>Nachricht: </strong> {$message} </p>
<p>Diese Nachricht wurde am {$date} um {$time} über {$sender} gesendet.</p>";

if($receiver){
mail($receiver,"Anfrage ".$name,$emailbody,$headers);
}
else{
mail('test@test.com',"Error",$emailbody,$headers);
}
}

//what we need to return back to our form
$returndata = array(
'posted_form_data' => array(
'name' => $name,
'email' => $email,
'website' => $website,
'budget' => $budget,
'message' => $message
),
'form_ok' => $formok,
'errors' => $errors
);

//if this is not an ajax request
if(empty($_SERVER['HTTP_X_REQUESTED_WITH']) && strtolower($_SERVER['HTTP_X_REQUESTED_WITH']) !== 'xmlhttprequest'){
//set session variables
session_start();
$_SESSION['cf_returndata'] = $returndata;

//redirect back to form
header('location: ' . $_SERVER['HTTP_REFERER']);
}
}

最佳答案

因为您知道收件人地址 - 您不应该传递它。提交表单时 - 您可以使用后端 PHP 脚本发送它,而根本不会将其暴露给用户!

关于php - 传递表单变量的安全方式,我们在Stack Overflow上找到一个类似的问题: https://stackoverflow.com/questions/16400895/

25 4 0
Copyright 2021 - 2024 cfsdn All Rights Reserved 蜀ICP备2022000587号
广告合作:1813099741@qq.com 6ren.com