'."\n"; if (@$_POST[''.$send_value.'']) { // Posted variables $name = $_POST['name']; $email = $_POST['email']; $phone = $_POST['phone']; $url = $_POST['url']; $reason = $_POST['reason']; $message = $_POST['message']; $formid = $_POST['GB'.$form_id.'']; $trap1 = $_POST['GB'.$trap1_value.'']; $trap2 = $_POST['p-mail']; $spamq = $_POST['spamq']; $gbcc = @$_POST['gbcc']; $ltd = date("l, F jS, Y \\a\\t g:i a", time()+$time_offset*60*60); $ip = getenv("REMOTE_ADDR"); $hr = getenv("HTTP_REFERER"); $hst = gethostbyaddr( $_SERVER['REMOTE_ADDR'] ); $ua = $_SERVER['HTTP_USER_AGENT']; // Strip slashes, html, php, binary, and scrub posted vars $name = stripslashes(strip_tags(trim($name))); $email = stripslashes(strip_tags(trim(strtolower($email)))); $phone = stripslashes(strip_tags(trim($phone))); $url = stripslashes(strip_tags(trim($url))); $reason = stripslashes(strip_tags(trim($reason))); $message = stripslashes(strip_tags(trim($message))); $spamq = strtolower(trim($spamq)); $gb_randoma = strtolower(trim($gb_randoma)); $ltd = stripslashes(strip_tags(trim($ltd))); $ip = stripslashes(strip_tags(trim($ip))); $hr = stripslashes(strip_tags(trim($hr))); $hst = stripslashes(strip_tags(trim($hst))); $ua = stripslashes(strip_tags(trim($ua))); $formid = stripslashes(strip_tags(trim($formid))); $send_value = stripslashes(strip_tags(trim($send_value))); // Email header $gb_email_header = "From: $gb_email_address\n"."Reply-To: $email\n"."MIME-Version: 1.0\n"."Content-type: text/plain; charset=\"utf-8\"\n"."Content-transfer-encoding: quoted-printable\n\n"; // Strip more html, php, and binary, then scrub $gb_email_header = stripslashes(strip_tags(trim($gb_email_header))); // Identify exploits $head_expl = "/(bcc:|cc:|document.cookie|document.write|onclick|onload)/i"; $inpt_expl = "/(content-type|to:|bcc:|cc:|document.cookie|document.write|onclick|onload)/i"; // Modify referrer to counter bogus www/no.www mismatch errors $form_location = strtolower(trim(rtrim(str_replace(array("http", "www", "&", "/", "#", "\\", ":", "%", "|", "^", ";", "@", "?", "+", "$", ".", "~", "-", "=", "_", " ",), '', $form_location)))); $new_referrer = strtolower(trim(rtrim(str_replace(array("http", "www", "&", "/", "#", "\\", ":", "%", "|", "^", ";", "@", "?", "+", "$", ".", "~", "-", "=", "_", " ",), '', $_SERVER['HTTP_REFERER'])))); // Carbon Copy request negotiation if($gbcc == "gbcc") { $gb_cc = ", $email"; $cc_notify1 = "".$x_or_h_br."(A carbon copy has also been sent to this address.)"; $cc_notify2 = "(Copy sent)"; $cc_notify3 = ""; } else { $gb_cc = ""; $cc_notify1 = ""; $cc_notify2 = ""; $cc_notify3 = ""; } // Required fields need stuffing or get an error showing fields needed if(!isset($name,$email,$reason,$message,$spamq) || empty($name) || empty($email) || empty($reason) || empty($message) || empty($spamq)){ print(' Results: '.$error_heading.'

Required Field(s) Missed: The following “Required” fields were not filled in. Using your “Back” button, please go back and fill in all required fields.

'."\n"); echo('

'."\n"); echo('

Empty Field(s):

'."\n"); if(empty($name)) { echo('

“Full name”

'."\n"); } if(empty($email)) { echo('

“Email address”

'."\n"); } if(empty($reason)) { echo('

“Subject”

'."\n"); } if(empty($message)) { echo('

“Message”

'."\n"); } if(empty($spamq)) { echo('

“'.$gb_randomq.'”

'."\n"); } echo('

'."\n"); } else { // Or the email doesn't seem to be properly formed or has illegal email characters if(!eregi("^[_a-z0-9-]+(\.[_a-z0-9-]+)*@[a-z0-9-]+(\.[a-z0-9-]+)*(\.[a-z]{2,6})", "$email")) { echo(' Results: '.$error_heading.'

Invalid Email Address: The email address you have submitted seems to be invalid. Using your “Back” button, please go back and check the address you entered. Please try not to worry, '.$i_or_we.' do respect your privacy.

'."\n"); // Anti-spam trap 1 } else if($trap1 !== "") { echo(' Results: '.$error_heading.'

Anti-Spam Trap 1 Field Populated: You populated a spam trap anti-spam input so you must be a spambot. Go away!

'."\n"); // Anti-spam trap 2 } else if($trap2 !== "") { echo(' Results: '.$error_heading.'

Anti-Spam Trap 2 Field Populated: You populated a spam trap anti-spam input that is meant to confuse automated spam-sending machines. If you accidently entered data in this field, using your “Back” button, please go back and remove it before submitting this form. Sorry for the confusion.

'."\n"); // Input length error tripping } else if(strlen($name) > 40 || strlen($email) > 40 || strlen($phone) > 30 || strlen($url) > 60 || strlen($gbcc) > 4) { echo(' Results: '.$error_heading.'

Input Maxlength Violation: Certain inputs have been populated beyond that which is allowed by the form. Therefore you must be trying to post remotely and are probably a spambot. Go away!

'."\n"); // Contact reason validation } else if(!in_array($reason, $gb_options)) { echo(' Results: '.$error_heading.'

Contact Reason Violation: You have tried to post a “Contact Reason” which doesn’t exist in '.$my_or_our.' menu. Therefore you must be trying to post remotely and are probably a spambot. Go away!

'."\n"); // Check the IP black list } else if(in_array($ip, $ip_blacklist)) { echo(' Results: '.$error_heading.'

Blacklisted IP Address: Sorry, but your IP address has been blocked. Perhaps you have abused your form submission privileges in the past. If you’ve sent spam to '.$me_or_us.' in the past, this could be the reason.

'."\n"); // Form value confirmation } else if($formid !== "GB".$form_id."") { echo(' Results: '.$error_heading.'

Form ID Value Mismatch: The submitted ID does not match registered ID of this form which means you’re trying to post remotely so this mean you must be a spambot. Go away!

'."\n"); // My long version of Jem's exploit killer } else if(preg_match($head_expl, $gb_email_header) || preg_match($inpt_expl, $name) || preg_match($inpt_expl, $email) || preg_match($inpt_expl, $phone) || preg_match($inpt_expl, $url) || preg_match($inpt_expl, $message)) { echo(' Results: '.$error_heading.'

Injection Exploit Detected: It seems that you’re possibly trying to apply a header or input injection exploit in '.$my_or_our.' form. If you are, please stop at once! If not, using your “Back” button, please go back and check to make sure you haven’t entered content-type, to:, bcc:, cc:, document.cookie, document.write, onclick, or onload in any of the form inputs. If you have and you’re trying to send a legitimate message, for security reasons, please find another way of communicating these terms.

'."\n"); // Let match the referrer to ensure it's sent from here and not elsewhere } else if($new_referrer !== $form_location) { echo(' Results: '.$error_heading.'

Referrer Missing or Mismatch: It looks like you’re trying to post remotely or you have blocked referrers on your user agent or browser. Using your “Back” button, please go back and try again or use '.$my_or_our.' regular email, '.$gb_email_address.', to circumvent Referrer Mismatch.

Attention Site Admin: Be sure to double check the last section in the form’s configuration file and edit accordingly. If “Form Location” is manually entered, make sure it matches the page URL exactly — as seen on your browser’s address bar. A misconfigured URL is typically the cause of this error.

'."\n"); // Anti-spam verification } else if($spamq !== "$gb_randoma") { echo(' Results: '.$error_heading.'

Anti-Spam Question/Answer Mismatch: The answer you supplied to the anti-spam question is incorrect. Using your “Back” button, please go back and try again or use '.$my_or_our.' regular email, '.$gb_email_address.', if having Anti-Spam question difficulty.

'."\n"); // And now let's see if the variable for submit matches what's required } else if(!(isset($_POST[''.$send_value.'']))) { echo(' Results: '.$error_heading.'

Submit Variable Mismatch: It looks like you’re trying to post remotely as the submit variable is unmatched. Using your “Back” button, please go back and try again or try '.$my_or_our.' regular email, '.$gb_email_address.', to circumvent Variable Mismatch.

'."\n"); // Holy smokes, looks like all's cool and we can send the message } else { $gb_content = "Hello $gb_contact_name,\n\nYou are being contacted via $gb_website_name by $name. $name has provided the following information so you may contact them:\n\n Email: $email $cc_notify2\n Phone: $phone\n Website: $url\n Subject: $reason\n\nMessage:\n $message\n\n\n--------------------------\nOther Data and Information:\n IP Address: $ip\n Time Stamp: $ltd\n Referrer: $hr\n Host: $hst\n User Agent: $ua\n Resolve IP Whois: http://ws.arin.net/cgi-bin/whois.pl?queryinput=3D$ip\n\n"; $gb_ccmail = "Hello $name,\n\nThis is a copy of the email you sent to $gb_website_name. If appropriate to your message, you should receive a response quickly. You successfully sent the following information:\n\n Email: $email $cc_notify3\n Phone: $phone\n Website: $url\n Subject: $reason\n\nMessage:\n $message\n\n\n--------------------------\nOther Data and Information:\n Time Stamp: $ltd\n\n"; // Remove tags and slashes from content-including header then trim it again $gb_content = stripslashes(strip_tags(trim($gb_content))); $gb_ccmail = stripslashes(strip_tags(trim($gb_ccmail))); // Add in -f parameter $param = "-f $gb_email_address"; // The mail function helps, let's send this stuff mail("$gb_email_address", "[$gb_website_name] Contact from $name", $gb_content, $gb_email_header, $param); if($gb_cc !== "") { mail("$gb_cc", "[Copy] Email sent to $gb_website_name", $gb_ccmail, $gb_email_header, $param); } // And let's inform the user and show them what they sent echo(' Results: '.$success_heading.' [ Reset Form ]

Message Sent: You have successfully sent a message to '.$me_or_us.', '.$name.'. If appropriate to your message, '.$i_or_we.' will get back to you shortly. You submitted the following information:

• Name: '.$name.'
• Email: '.$email.' '.$cc_notify1.'
• Phone: '.$phone.'
• Website: '.$url.'
• Subject: '.$reason.'

Message:

'.$message.'

—'.$name.'

Time Stamp:

Form Submitted: '.$ltd.'

'."\n"); } } } else { // No errors so far? No successes so far? No confirmation? Hmm. Maybe the user needs a contact form ?>Warning! It seems that the PHP mail() function isn’t enabled on your server. Sorry, but to use this plugin this function must be enabled. Please contact your web hosting provider to ask if they will enable this function for your domain. Optionally, should your web hosting provider deny your request, you may want to try this PHP Email Protector script.

'); } ?>

#results">

Contact [ Privacy ]

'); } else { echo(''); } ?>

Required:

Full name*> Email address*>

>Optional:

Phone number>

Required:

Subject* Please make a selection '.$gb_opts.''."\n"); } ?> Message* >

Note: The input below should not be filled in. It is a spam trap. Please ignore it. If you populate this input, the form will return an error. >

> Check this box if you want a carbon copy of this email.'.$x_or_h_br.''."\n"); } else { echo(''."\n"); } ?>
> '."\n"); } ?>

'."\n"); ########################################################## ?>