PHP form

[AndrewNR]

I'm trying to implement the contact form from
http://www.w3schools.com/php/showphp.asp?filename=demo_form_validation_complete

I have removed the: "gender", "website" and "check your input" parts so I am left with the following code:

<?php
			// define variables and set to empty values
			$nameErr = $emailErr = "";
			$name = $email = $comment = "";

			if ($_SERVER["REQUEST_METHOD"] == "POST") 
			{
   				if (empty($_POST["name"])) 
				{
     					$nameErr = "Name is required";
   				} 
				else 
				{
     					$name = test_input($_POST["name"]);
     					// check if name only contains letters and whitespace
     					if (!preg_match("/^[a-zA-Z ]*$/",$name)) 
					{
       						$nameErr = "Only letters and white space allowed"; 
     					}
   				}
   
   				if (empty($_POST["email"])) 
				{
     					$emailErr = "Email is required";
   				} 
				else 
				{
     					$email = test_input($_POST["email"]);
     					// check if e-mail address is well-formed
     					if (!filter_var($email, FILTER_VALIDATE_EMAIL)) 
					{
       						$emailErr = "Invalid email format"; 
     					}
   				}
     
   				if (empty($_POST["comment"])) 
				{
     					$comment = "";
   				} 
				else 
				{
     					$comment = test_input($_POST["comment"]);
   				}
			}

			function test_input($data) 
			{
   				$data = trim($data);
   				$data = stripslashes($data);
   				$data = htmlspecialchars($data);
   				return $data;
			}
		?>

	<p><span class="error">* required field.</span></p>
	
	<form method="post" action="<?php echo htmlspecialchars($_SERVER["PHP_SELF"]);?>"> 
	
   	Name: <input type="text" name="name" value="<?php echo $name;?>">
   	<span class="error">* <?php echo $nameErr;?></span>
   	<br><br>

   	E-mail: <input type="text" name="email" value="<?php echo $email;?>">
   	<span class="error">* <?php echo $emailErr;?></span>
   	<br><br>

   	Comment: <textarea name="comment" rows="5" cols="40"><?php echo $comment;?></textarea>
   	<br><br>

        <input type="submit" name="submit" value="Submit">
	<br><br>
	</form>

But in the website I get two errors:

1. under required field the Name is ... ">Name: [------] rather than Name: [------]

I can remove this error by changing:

<form method="post" action="<?php echo htmlspecialchars($_SERVER["PHP_SELF"]);?>">

To

<form method="post" action="<?php echo htmlspecialchars($_SERVER["PHP_SELF"]);?>

But I'm not sure if I'm supposed to?

2. My boxes contain:
<?php echo $name;?> (in name) <?php echo $email;?> (in email) and <?php echo $commentl;?> (in email)

Obviously coming from here:

value="<?php echo $name;?>">

Same error as number 1.? I assume the variables are set with an empty String but this is being pulled through?

I have absolutely no php experience so last question: Where do you input the email address that is to be the recipient?

Thanks.

 

[AndrewNR]

try this:

	<form method="post" action="<?php echo htmlspecialchars($_SERVER[\"PHP_SELF\"]);?>">

or this if escaping doesn't work:

	<form method="post" action="<?php echo htmlspecialchars($_SERVER['PHP_SELF']);?>">

Do you see what was happening or do you need more info?

e: fix the first problem first as it's causing leaking no doubt and PHP is about as fun as playing mystery box with a box full of rusty nails when it comes to debugging.

The second one seems to have worked.

Thanks a lot.

Just the stuff appearing in the boxes now and then understanding how to handle/receive submissions.

Is it worth including an anti-spam feature/check for humans?

 

[AndrewNR]

it really depends on what you're doing it for. If it's just some exploratory stuff why not, play away until your hearts content.

It's for a website I'm currently working on so I want it to work.

Will this be similar to the first issue?

value="<?php echo $name;?>">

At the moment it is populating the name, email and comment fields respectively.