I need a simple contact form for my website, but I want some defence against spam. Like a Chapta or something.

Dani AI

Generated

Quick summary and practical paths given ’s constraint (no PHP): the PHP examples suggested by and won’t run on a host that doesn’t support server‑side scripting. is right that PHP on the server is the cleanest long‑term fix, but there are reliable alternatives that avoid changing hosts.

If you must stay on static/limited hosting: use a third‑party form processor (services exist that accept a POST and forward submissions by email), embed a hosted form or iframe, or collect responses with a form service (Google Forms works for basic needs). For more control without PHP, use a serverless endpoint (Netlify/Vercel/AWS Lambda) that receives the POST and sends mail via an SMTP/API provider. Avoid mailto: for production: it’s unreliable and exposes user mail clients.

Notes on the posted PHP (from ): it contains definite bugs and security risks — for example, an undefined $message is used when calling mail(), the user’s email is put directly into the From header (bad for header‑injection and deliverability), and input is read via $_REQUEST without sanitization. Improve any PHP handler by validating with filter_var($email, FILTER_VALIDATE_EMAIL), rejecting CRLF in header fields, using a proper mail library (PHPMailer/SMTP) with an authenticated domain address as From and the user as Reply-To, and implementing spam controls (honeypot + CAPTCHA) plus rate‑limiting and server‑side validation.

Short checklist (actionable):

  • Confirm what your host supports (HTML only, JS, serverless, SMTP). (’s point.)
  • If no server code: pick a hosted form service or serverless function.
  • Always validate and sanitize on the server side; never trust client input.
  • Use domain‑based From and Reply‑To, or authenticated SMTP to avoid spam filtering.
  • Add a simple honeypot + CAPTCHA and test deliverability and logs.

This gives workable options now and a secure upgrade path if you can add PHP later.

Recommended Answers

All 5 Replies

Well if you tell us what technologies your hosting company support we can help you more...

If you do not have PHP installed, then using contact form is pointless. Scenes all effective and powerful forms are used in PHP.

If I were you, I would try and get a server with PHP installed, then visit.
www.freecontactform.com

They are very good forms, and work well with little modifications.

<?php

$to = "your-email";
$from = $_REQUEST['email'];
$name = $_REQUEST['name'];
$comments = $_POST['comments'];
$subject1 = "'******SJSD ENQUIRY*****'" ;
$headers = "From: [email]webmaster@highweb.co.uk[/email]";
$subject = $_POST['subject'];
$verif_box = $_REQUEST["verif_box"];

$fields = array();
$fields["name"] = "name";
$fields["subject"] = "subject";
$fields["email"] = "email";
$fields["comments"] = "comments";
$fields["find_us"] = "find_us";

if(md5($verif_box).'a4xn' == $_COOKIE['tntcon'])	
$body = "we have received the following information:\n\n";
foreach($fields as $a => $b) {
$body .= sprintf("%20s: %s\n", $b, $_REQUEST[$a]);
}

$headers2 = "From: [email]webmaster@highweb.co.uk[/email]";
$subject2 = "Thank you for contacting us";
$autoreply = "Thank you for contacting us. Somebody will get back to you as soon as possible, usualy within 48 hours. If you have any more questions, please consult our website at www.oursite.com";
if(md5($verif_box).'a4xn' == $_COOKIE['tntcon']){
	// if verification code was correct send the message and show this page
	mail("you@email.com", 'Online Form: '.$subject, $_SERVER['REMOTE_ADDR']."\n\n".$message, "From: $from");
	// delete the cookie so it cannot sent again by refreshing this page
	setcookie('tntcon','');
} else {
	// if verification code was incorrect then return to contact page and show error
	header("Location:".$_SERVER['HTTP_REFERER']."?subject=$subject&from=$from&message=$message&wrong_code=true");
	exit;
}

if($from == '') {
print "you have not entered an email, please go back and try again";
} else {
if (!preg_match("/\w+([-+.]\w+)*@\w+([-.]\w+)*\.\w+([-.]\w+)*/", $from)) {
  echo "<h4>Invalid email address</h4>";}
else {
if($comments == '') {
print "you have not entered comments , please go back and try again";
} else {
if($subject == '') {
print "you have not entered subject , please go back and try again";
} else {
$send = mail($to, $subject1, $body, $headers);
$send2 = mail($from, $subject2, $autoreply, $headers2);
if($send) {
print ("Thank you");
} else {
print "We encountered an error sending your mail, please notify [email]webmaster@highweb.co.uk[/email]";
}
}
}
}
}
?>

</body>
</html>
Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.