Member Avatar for Violet_82

Hi all, I need to add a contact form to a site I'm working on. I'm just thinking whether it would be better to go with an online solution (grab a form from somewhere and use it on my site) or building my own thing (complete with captcha etc). I'm not really good at php although I did build a very basic php form a very long time ago. Do you guys think it is better to go for an already made one? One of the things I'm slightly concerned about if I get one from the net is privacy: would that be an issue as I don't know where the data collected go?
what do you guys think?

  • 2 Contributors
  • 5 Replies
  • 436 Views
  • 1 Week Discussion Span
  • Latest Post Latest Post by Violet_82

Dani AI

Generated

Brief, practical roadmap for this thread (ties to and ):

Building your own handler keeps control of user data; that directly addresses the privacy worry raised by . If PHP comfort is limited, a pragmatic middle path is to host the form and processing on your own server while using a small, well-maintained mail library (for example PHPMailer) rather than copying random scripts off the web. As suggested, any third-party code should be audited before use.

Checklist (minimum requirements)

  • Server-side validation: require and validate fields (use filter_var for email), trim and cap lengths, and remove HTML when storing or emailing.
  • Prevent header injection: strip CR/LF from any header values (name/email) used in From or custom headers.
  • Avoid SQL injection: use parameterized queries/prepared statements for any storage.
  • Output encoding: escape user input when redisplaying to prevent XSS.
  • Spam controls: add a honeypot or timestamp check, rate-limit submissions, and add CAPTCHA or an equivalent anti-bot measure.
  • Delivery/security: send mail via authenticated TLS SMTP (use a library), set correct From/Reply-To, and configure SPF/DKIM for deliverability.
  • Privacy/compliance: if data leaves your server, review the provider privacy policy and retention rules; log and store only what you need.

Minimal PHP pattern (illustrative)

<?php
$name = substr(trim($_POST['name'] ?? ''),0,100);
$email = $_POST['email'] ?? '';
$msg  = substr(trim($_POST['message'] ?? ''),0,2000);

if (!filter_var($email, FILTER_VALIDATE_EMAIL) || $msg === '') {
  http_response_code(400); exit('Invalid input');
}

function no_crlf($s){ return str_replace(array("\r","\n"),'', $s); }
$from = no_crlf($email);
$body = "From: ".strip_tags($name)." <{$from}>\n\n".strip_tags($msg);

// Use a maintained library (PHPMailer) to send securely over SMTP
mail('site@domain.com','Contact form',$body,"From: {$from}");
?>

Summary guidance: given the skill level shown, prefer a server-side solution using a maintained library, apply the checklist above, and if you opt for an external form provider audit their privacy and security practices first (and host the form markup locally if possible).

Recommended Answers

All 5 Replies

Member Avatar for Member #120589

Well, the form should be HTML. Only very basic PHP would be required if at all. The back-end is down to you. You can DIY or use an authentication script - BUT - if you go 3rd party script - you MUST inspect the code with a tooth-comb - it could be an enormous security risk, if not done right. There are thousands of auth scripts out there. I'd advise you to read up on auth security, e.g. OWASP first so that you're aware of how malicious users could get into your system.

Member Avatar for Violet_82

What I'm thinking is that if I go for a DIY solution, how do I make sure that my code isn't in fact a security risk as opposed to one found on the web? I'm tempted to attemp my own, but I will obviously need help from the community as my php isn't so great

Member Avatar for Member #120589

Well ok, if you need help we're here. But my beef with using 3rd party scripts (I'm thinking small classes etc - not Framework-based ones), is that "devs" seem to trust these more than their own code, without understanding what they do and how they do it. A thrid party script written by a senior or seasoned developer may well be more secure that anything you could knock up yourself, but you should have the ability to check the code; e.g. I've seen some right horrible scripts - SQL Injections and XSS vulnerabilities all over the place.

Member Avatar for Violet_82

Cool, thanks, I think I'll have a go at it and see if I can knock up something quick. Will open a new thread

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.