Databases
StackOverflow2013
Postsdbo
POsecure way of passing form variable
 

Note that there are some explanatory texts on larger screens.

plurals
  1. POsecure way of passing form variable
    primarykey
    data
    text
    <p>Im building a contact form for my wordpress theme. I want the ability to enter a receiver adress from the backend. At the moment I am passing the variable with a hidden input field.</p> <pre><code>&lt;input type="text" class="hidden" name="receiver" value="&lt;?php get_option('admin_email') ?&gt;"/&gt; </code></pre> <p>I read that I shouln't do this, because its insecure. But how would I do it then?</p> <p>Edit: Here is my process.php. I tried to get the admin email but that breaks it somehow.</p> <pre><code>&lt;?php if( isset($_POST) ){ //form validation vars $formok = true; $errors = array(); //sumbission data $ipaddress = $_SERVER['REMOTE_ADDR']; $date = date('d.m.Y'); $time = date('H:i'); //form data $name = $_POST['name']; $email = $_POST['email']; $website = $_POST['website']; $budget = $_POST['budget']; $message = $_POST['message']; $receiver = $_POST['receiver']; $sender = get_option('admin_email'); if(empty($name)){ $formok = false; $errors[] = "Sie haben keinen Namen angegeben."; } if(empty($email)){ $formok = false; $errors[] = "Sie haben keine Emailadresse angegeben."; //validate email address }elseif(!filter_var($email, FILTER_VALIDATE_EMAIL)){ $formok = false; $errors[] = "Sie haben keine gültige Emailadresse angegeben."; } if(empty($message)){ $formok = false; $errors[] = "Das Nachrichtenfeld ist leer."; } elseif(strlen($message) &lt; 20){ $formok = false; $errors[] = "Ihre Nachricht muss mindestens 20 Zeichen enthalten."; } if($formok){ $headers = "From: {$email}" . "\r\n"; $headers .= 'Content-type: text/html; charset=UTF-8' . "\r\n"; $emailbody = "&lt;p&gt;&lt;strong&gt;Name: &lt;/strong&gt; {$name} &lt;/p&gt; &lt;p&gt;&lt;strong&gt;Website: &lt;/strong&gt; {$website} &lt;/p&gt; &lt;p&gt;&lt;strong&gt;Nachricht: &lt;/strong&gt; {$message} &lt;/p&gt; &lt;p&gt;Diese Nachricht wurde am {$date} um {$time} über {$sender} gesendet.&lt;/p&gt;"; if($receiver){ mail($receiver,"Anfrage ".$name,$emailbody,$headers); } else{ mail('test@test.com',"Error",$emailbody,$headers); } } //what we need to return back to our form $returndata = array( 'posted_form_data' =&gt; array( 'name' =&gt; $name, 'email' =&gt; $email, 'website' =&gt; $website, 'budget' =&gt; $budget, 'message' =&gt; $message ), 'form_ok' =&gt; $formok, 'errors' =&gt; $errors ); //if this is not an ajax request if(empty($_SERVER['HTTP_X_REQUESTED_WITH']) &amp;&amp; strtolower($_SERVER['HTTP_X_REQUESTED_WITH']) !== 'xmlhttprequest'){ //set session variables session_start(); $_SESSION['cf_returndata'] = $returndata; //redirect back to form header('location: ' . $_SERVER['HTTP_REFERER']); } } </code></pre>
    singulars
    1. PO
      singulars
      1. PTAnswer
    1. This table or related slice is empty.
    1. PTQuestion
    1. USSebastian Starke
    1. USSebastian Starke
    plurals
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. PO
      singulars
      1. PTAnswer
    2. PO
      singulars
      1. PTAnswer
    3. PO
      singulars
      1. PTAnswer
    1. VO
      singulars
      1. POsecure way of passing form variable
      1. This table or related slice is empty.
      1. VTUpMod
    2. VO
      singulars
      1. POsecure way of passing form variable
      1. This table or related slice is empty.
      1. VTUpMod
    1. COAre you using a plugin for the contact form, or are you writing the PHP code on the backend to process the form? I would recommend looking at Jetpack for it's ability to put forms on your pages.
      singulars
      1. POsecure way of passing form variable
      1. USTim Dorr
    2. CONo, I'm writing it by myself.
      singulars
      1. POsecure way of passing form variable
      1. USSebastian Starke
 

Querying!

 
Guidance
A row detail

Detail views are divided into sections. All the information in the data section comes from columns in the selected row. The other sections display data from other, related rows.

Related data can be related in a to-one or a to-many fashion. Captions of data related in a to-many fashion link to a list view showing a filtered view of the table.

Try moving around until you find a non-empty to-many entry and click on the label to get to one. You can move back to the root by clicking on the database name in the header.

SQuiL has stopped working due to an internal error.

If you are curious you may find further information in the browser console, which is accessible through the devtools (F12).

Reload