Randomly receiving empty emails via PHP script [duplicate] - php

Question

This question already has answers here:
Relying on HTML 'required' for simple form validation
(4 answers)
Closed 1 year ago.
I am a beginner helping my aunt build a personal website. I have an HTML form where users can contact her (slightly simplified for clarity):
<form id = "contact-form" method = "post" action = "contact-form-handler.php">
<input name = "name" type = "text" required><br>
<input name = "email" type = "email" required><br>
<textarea name = "message" class = "form-control" required></textarea><br>
<input type = "submit" class = "form-control submit" value = "SEND MESSAGE">
</form>
The script contact-form-handler.php reads,
<?php
$name = $_POST['name'];
$visitor_email = $_POST['email'];
$message = $_POST['message'];
$email_from = "SEND_EMAIL#ADDRESS.com";
$email_subject = "Message from fziastories";
$email_body = "Name: $name.\n".
"Email: $visitor_email.\n".
"Message: $message.\n";
$to = "RECIEVE_EMAIL#ADDRESS.com";
$headers = "From: $email_from \r\n";
$headers .= "Reply-To: $visitor_email \r\n";
mail($to,$email_subject, $email_body, $headers);
header("Location: index.html");
?>
This form works great. When I enter various tests, the message goes through perfectly. And when I don't enter a value for one of the three inputs, I am not able to hit the 'SEND MESSAGE' button.
Except, every once in a while, maybe once or twice a week, I receive an empty message with no values filled out. This is confusing to me because I figure the current setup precludes users from submitting the form without entering value but also through the tests I have ruled out the possibility that a valid response is being entered as blanks.
I would greatly appreciate any advice! If you have any follow-up questions, do not hesitate to ask. Thank you!

Answer 1

The required tag in HTML forms is not very secure!
You should always validate the data on your server.
This could look something like this:
<?php
$name = $_POST['name'];
$visitor_email = $_POST['email'];
$message = $_POST['message'];
if (empty($_POST['name']) || empty($_POST['email']) || empty($_POST['message'])) {
header("Location: index.html");
exit;
}
$email_from = "SEND_EMAIL#ADDRESS.com";
$email_subject = "Message from fziastories";
$email_body = "Name: $name.\n".
"Email: $visitor_email.\n".
"Message: $message.\n";
$to = "RECIEVE_EMAIL#ADDRESS.com";
$headers = "From: $email_from \r\n";
$headers .= "Reply-To: $visitor_email \r\n";
mail($to,$email_subject, $email_body, $headers);
header("Location: index.html");
?>