Is my form safe? - php

Question

I have been trying to read up a lot about trying to get a safe html form to email me something. I have created a form but I'm curious about it's safety. I haven't added the e-mail controls yet.
Since it will be up on a website I'm terrified of any injections. What I have done so far is use the htmlentities() to protect the action, used the test_input function from w3 schools and used the require function but I know that can be easily taken out.
Thanks in advance!
<?php
// define variables and set to empty values
$name = $email = $gender = $comment = $website = "";
function test_input($data) {
$data = trim($data);
$data = stripslashes($data);
$data = htmlspecialchars($data);
return $data;}
if ($_SERVER["REQUEST_METHOD"] == "POST") {
$name = test_input($_POST["name"]);
$email = test_input($_POST["email"]);
$website = test_input($_POST["telnr"]);
$comment = test_input($_POST["message"]);
echo"Bedankt voor het invullen, we nemen zo snel mogelijk contact met u op.";
}
else{
?>
<form action="<?php echo htmlentities($_SERVER["PHP_SELF"]);?>" method="post">
<div class="form-group row">
<label for="inputEmail3" class="col-sm-2 col-form-label">naam</label>
<div class="col-sm-10">
<input type="text" class="form-control" name="name" placeholder="naam" required>
</div>
</div>
<div class="form-group row">
<label for="inputPassword3" class="col-sm-2 col-form-label">e-mail</label>
<div class="col-sm-10">
<input type="email" class="form-control" name="email" placeholder="e-mail" required>
</div>
</div>
<div class="form-group row">
<label for="inputPassword3" class="col-sm-2 col-form-label">tel.nr</label>
<div class="col-sm-10">
<input type="tel" class="form-control" name="telnr" placeholder="telefoonnummer" required>
</div>
</div>
<div class="form-group row">
<label for="inputPassword3" class="col-sm-2 col-form-label">bericht</label>
<div class="col-sm-10">
<input type="text" class="form-control" name="message" placeholder="bericht" required>
</div>
</div>
<div class="form-group row text-center">
<div class="offset-sm-2 col-sm-10">
<button type="submit" class="btn btn-primary">Verstuur bericht!</button>
</div>
</div>
</form>
<?php } ?>

Answer 1

Definitely good to escape the PHP_SELF value although, unless you need the portability it provides, you can always simplify things a bit and hardcode the form target.