html email form

jobless

hi,

I'm looking for some html form help.....basically i want to have a form on a webpage and when someone hits submit, the results get sent to me by email....
Does anyone know a simple way of doing this?...or could you direct me somewhere....i've seen a php example...but is there another way?

cheers

Third_Echelon

there is a script called formmail that is readily available on the net which is very good.. just do a google for formmail.cgi or formmail.pl

ive used it loads of times... does the job fine...

steve-hosting36

Your host should have a standard way of doing this, drop them an email about it

seamus

For something very simple, you can use

<form action="mailto:myemail@email.com" method="post">

Which will actually just email the data directly from the form. Of course, this will normally require the user to have mail correctly set up on their machine and to consent to it. It also doesn't allow you to hide your email address.

Other than that, there are plenty of script available on the web that'll do it for you.

leeroybrown

If you use FormMail be sure that you pick an up-to-date version that has no security issues. In the past, some versions have had bugs that facilitated relaying spam.

If you have access to PHP on the server then a simple script that reads in the POST'ed data and uses a multiline string to format the message before passing it to the mail() function would be quite easy to implement and would also provide a high degree of control over the mail sent.

hostyle

formmail is notoriously insecure. Try NMS instead

mneylon

Originally posted by Third_Echelon
there is a script called formmail that is readily available on the net which is very good.. just do a google for formmail.cgi or formmail.pl

ive used it loads of times... does the job fine...

NO. Repeat after me: "formmail.cgi is evil"
Originally written back in '94 - '95 and published on Matt's archive it has been updated a few times but remains both one of the more popular mail scripts out there (with spammers) and one of the most insecure.
Most sane hosts do not allow it.
If you need a form mail there are plenty of perfectly good (and safe) PHP ones out there that DO NOT allow spammers to have a party on your server (or more pertinently that of your hosting provider)

leeroybrown

It's incredibly easy for some idiot to leave an ancient exploitable copy of FormMail lying around and it certainly isn't funny when you realise that your SMTP throughput has gone up by a multiple thousands over the course of a few hours and have to figure out WTF is going on.

maryob1

If you are going to use formmail, make sure you get the new patched version, there was an issue with formmail that would allow a spammer can exploit your formmail script to flood thousands of Internet users with junk mail.

mneylon

Originally posted by maryob1
If you are going to use formmail, make sure you get the new patched version, there was an issue with formmail that would allow a spammer can exploit your formmail script to flood thousands of Internet users with junk mail.

No. Just don't use it.
It brings a whole new meaning to insecure.
Another point as well is that most people don't even rename the damned thing, so spammers can just go looking for formmail.pl or formmail.cgi
DO NOT USE IT

steve-hosting36

The patched version works fine blacknight.

mneylon

Originally posted by steve-hosting36
The patched version works fine blacknight.

It may do, but I do not trust it and neither do our sysadmins. It has caused far too many headaches in the past.

mneylon

http://www.securityfocus.com/corporate/research/top10attacks_q1_2002.shtml

http://www.net-security.org/article.php?id=503

http://isp-lists.isp-planet.com/isp-unix/0204/msg00030.html

It may have been patched since then, but we found a version from 1995 on a server only this week.

jobless

thanks blacknight...for the advice.....could you suggest something else (for a novice)

mneylon

Try this one:
http://www.ledscripts.com/index.php?page=free:php:ledformmail

Nice little php script.

steve-hosting36

I think anyone deploying scripts from 1995 would be causing a security risk

We for one, provide a version of formmail as a wizarded install with all our plans and its never caused an issue.

.-=MR. JOE=-.

I used to use a site that saved all the form scripts and all on their server (or whatever you pro's call it) and you just gave them your email address and they give you the lines of the HTML to include on the form.

Worked really well for me anyway!

I'll google for it later.

buddy

Originally posted by .-=MR. JOE=-.
I used to use a site that saved all the form scripts and all on their server (or whatever you pro's call it) and you just gave them your email address and they give you the lines of the HTML to include on the form.

Worked really well for me anyway!

I'll google for it later.

Bravenet.com??

I normally used a script eircom.net gave.

Where can we source an up to date patched copy of formmail??

.-=MR. JOE=-.

No it wasn't bravenet but dat's probably something similar.

ro_G

i know ezmlm and formmail have had their differences in the past but does anyone know if it possible to pass addresses via formmail 1.92 to ezmlm?

or is there another handy script for securely passing subscribe/unsubscribe addresses to ezmlm?

steve-hosting36

http://oss.gospelcom.net/src/ezconfirm/

Should do the trick.