PHP flood protection w/ sessions

[kingzl3y]

Yo, guess you know by the amount of threads in the forum that i'm new to pretty much everything.

I've got a working contact form, name, email and message.. php validation checks whether it's valid and stuff. but I remember when i first started learning php and stole a contact form about 2/3 years ago and it was compromised and i got flooded with spam.. trying to prevent that.. without the use of a captcha.

I've been playing around with sessions. when the form has been validated and mail has been sent OK.. then register a session.
then when that page is reloaded or clicked on again.. it checks to see whether a session has been registered.. if it has then DON'T display the contact form.. or if sessions aren't registered than show the form.

I can get this to work..and it works alright.

The one thing I'm having trouble with though is when the mail has been sent and the sessions have been registered and then the session checks are carried out..
I've used "exit;" to prevent the form from loading.. However by doing this it doesn't show the footer (or anything below the exit command)

Is there any possible way or a snippet of code that will in-effect exit the php script and skip it to show the footer?

Cheers
p.s. sorry for the massive amount of threads lately :(

[Trivkz]

Erm, I dont have the code you use, but something like:

function ShowEmailForm()
{
    if ( $_SESSION['EmailSend'] == true )
    {
        return; //This stop the function from running anymore.
    }else{
        echo'Show Email Form';
        $_SESSION['EmailSend'] = true;
    }
}

and then to use the function where ever you want the email for use

ShowEmailForm();

Thats how I would do it, I think ;3

[andersonmat]

That's one way to do it.

[kingzl3y]

how would you go about doing something like this broheim?

Cheers for that funktion btw, ill give it a bash!

[cas97]

So you want it to skip over the registration form if someone already sent it?

<?php
session_start();

if($_SESSION['didSendForm'] != true){
?>

<!-- Form here -->

<?php

}else{

?>

You've already sent the form!

<?php

}

?>

[Dragon Master]

[QUOTE=cas97;24888126]So you want it to skip over the registration form if someone already sent it?

<?php
session_start();

if($_SESSION['didSendForm'] != true){
?>

<!-- Form here -->

<?php

}else{

?>

You've already sent the form!

<?php

}

?>

[/QUOTE]

This method looks like the one I would use.

Infact, I will, thanks cas97.

But why do you have seperate code blocks? you can optimise that code alot.

<?php

session_start();
    $sentform = true;
    if($_SESSION['didSendForm'] != $sentform){
       <!-- Form here -->
    }
    else{ echo "You've already sent the form!"
    }

?>

This is the method I would use.

[andersonmat]

I'd also use isset().

[cas97]

[QUOTE=Dragon Master;24890052]
But why do you have seperate code blocks?[/QUOTE]

It would work both ways, but I just said that because it's kind of easy to put in HTML or whatever he'd want in there without using echo
Edit: Although it is a good idea to put it inside an echo once finished

[deadeye536]

[QUOTE=Dragon Master;24890052]But why do you have seperate code blocks? you can optimise that code alot.[/QUOTE]

If it's my understanding, PHP is not significantly affected performance wise due to whitespace. You would have more of a performance gain by using isset() or emtpy() [url=http://stackoverflow.com/questions/2389752/php-speed-what-is-faster-if-isset-foo-or-if-footrue/2389764#2389764]instead of an operator (as andersonmat suggested).[/url]

[Crhem van der B]

[QUOTE=andersonmat;24890623]I'd also use isset().[/QUOTE]

I prefer empty().

[andersonmat]

[QUOTE=Crhem van der B;24893304]I prefer empty().[/QUOTE]

Cool, even though you have no idea what I was referring to.

if(isset($_SESSION['didSendForm']) &&  $_SESSION['didSendForm'] == true){

isset() makes sure you won't throw an error when comparing values.

[Crhem van der B]

Ah, it's a different situation then, sorry, didn't read the whole thread before posting.

[nivek]

[QUOTE=andersonmat;24896647]Cool, even though you have no idea what I was referring to.

if(isset($_SESSION['didSendForm']) &&  $_SESSION['didSendForm'] == true){

isset() makes sure you won't throw an error when comparing values.[/QUOTE]

Wouldn't

if(!empty($_SESSION['didSendForm']) &&  $_SESSION['didSendForm'] == true){

Work? I really don't know though I have never tried it for comparing.

Not that it really matters, especially since I prefer using isset() as well.

[cas97]

:colbert:
I don't understand why you use a function [i]and[/i] see if it's true.
If it's true, then it's definitely set, and it's not empty.

Maybe just use $_SESSION['didSendForm'] === true, as it checks it's true and not 1 or '1'?

[kingzl3y]

ignore that..

fixed it..

<?php

if($_SESSION['didSendForm'] != true){
						 if(!$_POST['CntctBtn']){
						?>
						
								  <form action="<?php $_SERVER['PHP_SELF'] ?>" method="post">
 								   <p><label class="mylabelstyle">name:</label>
 								   <input name="contactname" type="text" class="myinputstyle" value=""/>
								      <br />
								   <label class="mylabelstyle">email:</label>  
								    <input name="contactemail" type="text" class="myinputstyle" value=""/>
								    <br />
								    <label class="mylabelstyle">message:</label>  
								<textarea name="contactmessage" cols="21" rows="5" class="myinputstyle" value=""></textarea>
								<br />
 								 <input name="CntctBtn" type="submit" value="Viva la send" class="myinputstyle" /></p>
 								 </form>
 								 <?php
						}
							else {
										
									   if (sizeof($mistakes) > 0){
									   echo "<p>";	
									   echo "<ul>";
									   foreach ($mistakes as $errors){
									   echo "<li>$errors</li>";
									   }				 				
									  	echo "</ul>";
									  	echo "</p>"; 
										echo "<p> <a href=\"#/contact\">try again</a></p>";
										}
										else {
										echo "<p>Cheers. I'll have a read and get back to you.<br />";
											$headers ="MIME-Versin: 1.0\r\n" . 							   "Content-type: text/plain; charset=ISO-8859-1; format=flowed\r\n" . 										  "Content-Transfer-Encoding: 8bit\r\n" . 										  "From: $contactemail\r\n" . 										   "X-Mailer: PHP" . phpversion(); 										  mail('emailaddress', 'someone sent a you a message', $contactmessage, $headers);										  echo "Name: $contactname<br />";										  echo "Email: $contactemail<br />";										  echo "Message: $contactmessage</p>";										  session_register('didSendForm');										  $_SESSION['didSendForm'] = true;											}								}
}		
else  {
echo "<p>form adready sent</p>";
  }

?>

it was all down to if statements not having enough } ..

note to self: fucking double check

[andersonmat]

[QUOTE=nivek;24897748]Not that it really matters, especially since I prefer using isset() as well.[/QUOTE]

isset() makes sure that the variable is declared, empty() checks for it being empty, false, or null. :smile:

[nivek]

[QUOTE=andersonmat;24899933]isset() makes sure that the variable is declared, empty() checks for it being empty, false, or null. :smile:[/QUOTE]

Which is why in this case either could work cause :(

[andersonmat]

[QUOTE=nivek;24942115]Which is why in this case either could work cause :([/QUOTE]

I stated that if you compared directly it could throw an error because calling the array index would be undefined. Therefore, you need to check if it [b]exists[/b] and [i]then[/i] you can compare it.

[nivek]

[QUOTE=andersonmat;24942469]I stated that if you compared directly it could throw an error because calling the array index would be undefined. Therefore, you need to check if it [b]exists[/b] and [i]then[/i] you can compare it.[/QUOTE]

Touché.

[M-D]

This won't be very effective. Most (all?) spam bots ignore cookies and most of them also strip SESSIONID from the URL, meaning the server will create a new cookie with each request.