Web Wiz - Green Windows Web Hosting

  New Posts New Posts RSS Feed - Help with Adding Code
  FAQ FAQ  Forum Search   Events   Register Register  Login Login

Forum LockedHelp with Adding Code

 Post Reply Post Reply
Author
hawkmanva View Drop Down
Newbie
Newbie


Joined: 25 July 2006
Status: Offline
Points: 13
Post Options Post Options   Thanks (0) Thanks(0)   Quote hawkmanva Quote  Post ReplyReply Direct Link To This Post Topic: Help with Adding Code
    Posted: 30 November 2007 at 2:10am
I added the lines of code to my form where people enter data.. call it contactus.asp. Image shows up fine. Upon submission I post data to mailform.asp that contains ASP code. I added

I added the lines below to my mailform.asp but I get an error when I submit the contactus.asp form.
<!-- Include file for CAPTCHA form processing -->
<!-- #include file="CAPTCHA/CAPTCHA_process_form.asp" -->

I think if I move the above lines below the <% Option Explicit %> it will work. The next question is how can I stop the entire process if the code is not correct? I don't want the form to be reset and lose the data they have entered. Can I make them stay on the same page? What code do I need to add to do that?

Here is the mailform.asp file
<!-- Include file for CAPTCHA form processing -->
<!-- #include file="CAPTCHA/CAPTCHA_process_form.asp" -->
<%
'If CAPTCHA is entered correctly run the following code
If blnCAPTCHAcodeCorrect = True Then

       'Place code here that is to run if CAPTCHA is entered correctly
       Response.Write("CAPTCHA code is correct")


'If CAPTCHA is NOT entered correctly run the following code
ElseIf blnCAPTCHAcodeCorrect = False Then

       'Place code here that is to run if CAPTCHA is NOT entered correctly
       Response.Write("CAPTCHA code is NOT correct")
End If
%>






<%@ Language=VBScript %>
<% Option Explicit %>
<%
    Dim strTo
    'The header/footer for the email.
    Const strHeader = "FAM Web Inquiry:"
    Const strFooter = " "

    'Who does this go to?
    'Const strTo = "xx@xxx.net"
     strTo = Request.Form("EmailTo")

   
    'This information is optional
    Dim strFrom, strSubject, strRedirectURL, strFromPath
   
    strFrom = Request.Form("txtEmail")
    if Len(strFrom) = 0 then strFrom = strTo
   
    strSubject = Request.Form("txtEmailSubject")
    if Len(strSubject) = 0 then strSubject = "FAM Website Inquiry"
   
    strRedirectURL = Request.Form("urlSendTo")
    if Len(strRedirectURL) = 0 then strRedirectURL = "/"
   
    strFromPath = Request.Form("urlFromPath")
    if Len(strFromPath) = 0 then strFromPath = "Contact Us"
   
   

    Dim strBody
    strBody = strHeader & ( vbCrLf & vbCrLf )
    strBody = strBody & ( "FORM: " & strFromPath & vbCrLf ) & _
          ( "FORM submitted at " & Now() & vbCrLf & vbCrLf )

    dim ix, formElementName, formElementValue, prefix, fldName
    For ix = 1 to Request.Form.Count
        formElementName = Request.Form.Key(ix)
        formElementValue = Request.Form.Item(ix)

        ' what type of field was that on the form?
        prefix = Left(formElementName,3)
       
        ' and throw away prefix to get actual field name
        fldName = Mid(formElementName,4)
       
        ' but change periods to spaces for readability
        fldName = Replace(fldName, "."," ")

        Select Case prefix
            ' if the prefix indicates this is a form field of interest...
            Case "txt","sel","rad","cbo","lst","chk":
                ' if user didn't answer this question, say so...
                if Len(formElementValue) = 0 then formElementValue = "UNANSWERED"
               
                ' then tack on the name of the field and the answer
                strBody = strBody & (fldName & ": " & formElementValue & vbCrLf)
        End Select
    Next
        
    strBody = strBody & ( vbCrLf & strFooter )

    'Time to send the email
    Dim objCDO
    Set objCDO = Server.CreateObject("CDO.Message")
    objCDO.To = strTo
    objCDO.From = strFrom

    objCDO.Subject = strSubject
    objCDO.TextBody = strBody
   

    objCDO.Send

    Set objCDO = Nothing

    'Send them to the page specified
    Response.Redirect strRedirectURL
%>


Edited by hawkmanva - 30 November 2007 at 2:30am
Back to Top
WebWiz-Bruce View Drop Down
Admin Group
Admin Group
Avatar
Web Wiz Developer

Joined: 03 September 2001
Location: Bournemouth
Status: Offline
Points: 9844
Post Options Post Options   Thanks (0) Thanks(0)   Quote WebWiz-Bruce Quote  Post ReplyReply Direct Link To This Post Posted: 30 November 2007 at 9:48am
The two lines:-

<%@ Language=VBScript %>
<% Option Explicit %>

Should always be the first to lines in any ASP file.

Your CDOSYS email sending code should replace the lines:-

   'Place code here that is to run if CAPTCHA is entered correctly
       Response.Write("CAPTCHA code is correct")

As this part of the code is already in <% and %> blocks you do not need to copy these parts from your CDOSYS email code.

Just as an extra point on CDOSYS is that there is a vulnerability within it that spammers can use to get it to sendout 1,000's of spam emails if you do not parse the form data to remove malicious data from it.

Spammers can place multiple email addresses separated by ; into the From, To, and Subject lines to manipulate the head content of the email and trick the mail server into sending out 1,000's of spam emails. You should parse these fields to remove the following characters:-

; - semicolon
: - colon
> - greater than (close tag)
< - less than (open tag)
, - comma
Back to Top
hawkmanva View Drop Down
Newbie
Newbie


Joined: 25 July 2006
Status: Offline
Points: 13
Post Options Post Options   Thanks (0) Thanks(0)   Quote hawkmanva Quote  Post ReplyReply Direct Link To This Post Posted: 30 November 2007 at 7:54pm
Thanks. That may be happening now. I keep getting blank emails with the same from and to address. How do I format the code to parse like you are saying? I found this mailForm script at 4Guysfromrolla.com.. so if you recomend a better one, I am all ears. I have limited coding experience so be warned.
 
If I do what you said about moving my form handler code to where it it says "do this if correct" would that prevent the page from being redirected and losing my info?
 
What I do now is I send the user to a new page that says "you didnt enter the right code, hit back button to try again.." I would like to just keep them on the same page. And since they use the back button, the image for them to enter doest change but isnt valid again either. So I commented out the line that makes it invalid (who knows what that will mess up). 
 
BTW -  I am a paid subscriber of your webwiz forum software. Nice job.
Back to Top
WebWiz-Bruce View Drop Down
Admin Group
Admin Group
Avatar
Web Wiz Developer

Joined: 03 September 2001
Location: Bournemouth
Status: Offline
Points: 9844
Post Options Post Options   Thanks (0) Thanks(0)   Quote WebWiz-Bruce Quote  Post ReplyReply Direct Link To This Post Posted: 30 November 2007 at 10:02pm
Read the form input into variables then remove all malicious code before using these variables in the mail form.

To make things as simple as possible the example you have used place the Request.Form("name") directly. In real life you should NEVER do this, all user input MUST be treated as bad data until you check it for malicious code.

What you need to have is read the form data into variables, eg:-

strForumEmail = Request.Form("txtEmail")#
strSubject = Request.Form("txtEmailSubject")

Once in the variables you can strip it for malicious code before it is used. The code below is taken directly from Web Wiz Forums so would need some tweaking:-

strSubject = Trim(Mid(Replace(strSubject, vbCrLf, ""), 1, 100))
   
    strRecipientName = Trim(Mid(strRecipientName, 1, 35))
    strFromEmailName = Trim(Mid(strFromEmailName, 1, 35))
    strRecipientEmailAddress = Trim(Mid(strRecipientEmailAddress, 1, 50))
    strFromEmailAddress = Trim(Mid(strFromEmailAddress, 1, 50))
   
    strRecipientName = Replace(strRecipientName, vbCrLf, "", 1, -1, 1)
    strFromEmailName = Replace(strFromEmailName, vbCrLf, "", 1, -1, 1)
    strRecipientEmailAddress = Replace(strRecipientEmailAddress, vbCrLf, "", 1, -1, 1)
    strFromEmailAddress = Replace(strFromEmailAddress, vbCrLf, "", 1, -1, 1)
   
    strRecipientName = Replace(strRecipientName, ",", "", 1, -1, 1)
    strFromEmailName = Replace(strFromEmailName, ",", "", 1, -1, 1)
    strRecipientEmailAddress = Replace(strRecipientEmailAddress, ",", "", 1, -1, 1)
    strFromEmailAddress = Replace(strFromEmailAddress, ",", "", 1, -1, 1)
   
    strRecipientName = Replace(strRecipientName, ";", "", 1, -1, 1)
    strFromEmailName = Replace(strFromEmailName, ";", "", 1, -1, 1)
    strRecipientEmailAddress = Replace(strRecipientEmailAddress, ";", "", 1, -1, 1)
    strFromEmailAddress = Replace(strFromEmailAddress, ";", "", 1, -1, 1)
   
    strRecipientName = Replace(strRecipientName, ":", "", 1, -1, 1)
    strFromEmailName = Replace(strFromEmailName, ":", "", 1, -1, 1)
    strRecipientEmailAddress = Replace(strRecipientEmailAddress, ":", "", 1, -1, 1)
    strFromEmailAddress = Replace(strFromEmailAddress, ":", "", 1, -1, 1)
   
    strRecipientName = Replace(strRecipientName, "<", "", 1, -1, 1)
    strFromEmailName = Replace(strFromEmailName, "<", "", 1, -1, 1)
    strRecipientEmailAddress = Replace(strRecipientEmailAddress, "<", "", 1, -1, 1)
    strFromEmailAddress = Replace(strFromEmailAddress, "<", "", 1, -1, 1)
   
    strRecipientName = Replace(strRecipientName, ">", "", 1, -1, 1)
    strFromEmailName = Replace(strFromEmailName, ">", "", 1, -1, 1)
    strRecipientEmailAddress = Replace(strRecipientEmailAddress, ">", "", 1, -1, 1)
    strFromEmailAddress = Replace(strFromEmailAddress, ">", "", 1, -1, 1)

Back to Top
hawkmanva View Drop Down
Newbie
Newbie


Joined: 25 July 2006
Status: Offline
Points: 13
Post Options Post Options   Thanks (0) Thanks(0)   Quote hawkmanva Quote  Post ReplyReply Direct Link To This Post Posted: 30 November 2007 at 11:13pm
Ok makes sense, I see what you are saying.. I'll give this a try. 
Back to Top
 Post Reply Post Reply

Forum Jump Forum Permissions View Drop Down

Forum Software by Web Wiz Forums® version 12.08
Copyright ©2001-2026 Web Wiz Ltd.


Become a Fan on Facebook Follow us on X Connect with us on LinkedIn Web Wiz Blogs
About Web Wiz | Contact Web Wiz | Terms & Conditions | Cookies | Privacy Notice

Web Wiz is the trading name of Web Wiz Ltd. Company registration No. 05977755. Registered in England and Wales.
Registered office: Web Wiz Ltd, Unit 18, The Glenmore Centre, Fancy Road, Poole, Dorset, BH12 4FB, UK.

Prices exclude VAT at 20% unless otherwise stated. VAT No. GB988999105 - $, € prices shown as a guideline only.

Copyright ©2001-2026 Web Wiz Ltd. All rights reserved.