Topic: Errors from form in php block

[willemjan]

Hello community.

My errorlog filles up with this kind of errors:

Code: [Select]

http://www.hervormddamwald.nl/index.php?page=contact
8: Undefined index: bericht
Bestand: /public/sites/www.hervormddamwald.nl/Sources/Subs-Portal.php(1174) : eval()'d code
Regel: 67

On that page I have setup an contact form. I think that causes the problem... If you need that code, I can get you that.

In a few weeks I get hundreds of these errors... Do you have an clue on what it could be?

[AngelinaBelle]

I agree -- it sounds as though you have created a custom php page and made an error.
You have tried to use an array element 'bericht' without creating that array element first.
This should be pretty easy to track down -- the syntax is

Code: [Select]

$arrayName['bericht']And the problem occurs on line 67 of the contents of your php page.
 
IF you are having trouble spotting it, feel free to post the code here.

[willemjan]

Ok, I'll try and track it down. This error actually happens on more then one array element. What should my action be?

[willemjan]

Could it be this:

Code: [Select]

      <label for="bericht">Bericht:</label><br />
      <textarea id="bericht" name="bericht" rows="8" style="width: 400px;">' .
      htmlspecialchars($_POST['bericht']) . '</textarea><br />


[AngelinaBelle]

That might be it. You should first check if $_POST['bericht] exists.
 
http://www.w3schools.com/php/php_post.asp
http://www.php.net/docs.php
 

[willemjan]

I think I'll better post the complete script. I'm actually not good at this....

Code: [Select]

<?php
session_start(); // zorg ervoor dat session_start ALTIJD bovenaan ALLES van je pagina staat, anders werkt het niet!
 
/*******************************
*        CONTACT FORMULIER                     *
*        contactformulier.php             *
*                                                             *
*        Author: Miranda Verburg         *
*        Datum: 10 september 2010     *
*                                                             *
*        Pas het e-mail adres aan     *
*        bij $mail_ontv en upload   *
*        het naar je webserver..         *
********************************/

// E-mailadres van de ontvanger
$mail_ontv = 'my@email.com'; // <<<----- voer jouw e-mailadres hier in!

// Speciale checks voor naam en e-mailadres
if ($_SERVER['REQUEST_METHOD'] == 'POST')
{
    // naam controle
    if (!ereg('^[ a-zA-Z-]+$', $_POST['naam']))
        $naam_fout = 1;
    // e-mail controle
    if (function_exists('filter_var') && !filter_var($_POST['mail'], FILTER_VALIDATE_EMAIL))
            $email_fout = 1;
    // antiflood controle
    if (!empty($_SESSION['antiflood']))
    {
        $seconde = 20; // 20 seconden voordat dezelfde persoon nog een keer een e-mail mag versturen
        $tijd = time() - $_SESSION['antiflood'];
        if($tijd < $seconde)
            $antiflood = 1;
    }
}

// Kijk of alle velden zijn ingevuld - naam mag alleen uit letters bestaan en het e-mailadres moet juist zijn
if (($_SERVER['REQUEST_METHOD'] == 'POST' && (!empty($antiflood) || empty($_POST['naam']) || !empty($naam_fout) || empty($_POST['mail']) || !empty($email_fout) || empty($_POST['bericht']) || empty($_POST['onderwerp']))) || $_SERVER['REQUEST_METHOD'] == 'GET')
{
    if ($_SERVER['REQUEST_METHOD'] == 'POST')
    {
        if (!empty($naam_fout))
            echo '<p>Uw naam mag alleen letters bevatten.</p>';
        elseif (!empty($email_fout))
            echo '<p>Uw e-mailadres is niet juist.</p>';
        elseif (!empty($antiflood))
            echo '<p>U mag slechts &eacute;&eacute;n bericht per ' . $seconde . ' seconde versturen.</p>';
        else
            echo '<p>U bent uw naam, e-mailadres, onderwerp of bericht vergeten in te vullen.</p>';
    }
        
  // HTML e-mail formlier
  echo '<form method="post" action="' . $_SERVER['REQUEST_URI'] . '" />
  <p>
  
      <label for="naam">Naam:</label><br />
      <input type="text" id="naam" name="naam" value="' . htmlspecialchars($_POST['naam']) . '" /><br />
      
      <label for="mail">E-mailadres:</label><br />
      <input type="text" id="mail" name="mail" value="' . htmlspecialchars($_POST['mail']) . '" /><br />
      
      <label for="onderwerp">Onderwerp:</label><br />
      <input type="text" id="onderwerp" name="onderwerp" value="' . htmlspecialchars($_POST['onderwerp']) . '" /><br />
      
      <label for="bericht">Bericht:</label><br />
      <textarea id="bericht" name="bericht" rows="8" style="width: 400px;">' . htmlspecialchars($_POST['bericht']) . '</textarea><br />
      
      <input type="submit" name="submit" value=" Versturen " />
  </p>
  </form>';
}
// versturen naar
else
{      
  // set datum
  $datum = date('d/m/Y H:i:s');
    
  $inhoud_mail = "===================================================\n";
  $inhoud_mail .= "Ingevulde contact formulier " . $_SERVER['HTTP_HOST'] . "\n";
  $inhoud_mail .= "===================================================\n\n";
  
  $inhoud_mail .= "Naam: " . htmlspecialchars($_POST['naam']) . "\n";
  $inhoud_mail .= "E-mail adres: " . htmlspecialchars($_POST['mail']) . "\n";
  $inhoud_mail .= "Bericht:\n";
  $inhoud_mail .= htmlspecialchars($_POST['bericht']) . "\n\n";
    
  $inhoud_mail .= "Verstuurd op " . $datum . " via het IP adres " . $_SERVER['REMOTE_ADDR'] . "\n\n";
    
  $inhoud_mail .= "===================================================\n\n";
  
  // --------------------
  // spambot protectie
  // ------
  // van de tutorial: http://www.phphulp.nl/php/tutorial/beveiliging/spam-vrije-contact-formulieren/340/
  // ------
  
  $headers = 'From: ' . htmlspecialchars($_POST['naam']) . ' <' . $_POST['mail'] . '>';
  
  $headers = stripslashes($headers);
  $headers = str_replace('\n', '', $headers); // Verwijder \n
  $headers = str_replace('\r', '', $headers); // Verwijder \r
  $headers = str_replace("\"", "\\\"", str_replace("\\", "\\\\", $headers)); // Slashes van quotes
  
  $_POST['onderwerp'] = str_replace('\n', '', $_POST['onderwerp']); // Verwijder \n
  $_POST['onderwerp'] = str_replace('\r', '', $_POST['onderwerp']); // Verwijder \r
  $_POST['onderwerp'] = str_replace("\"", "\\\"", str_replace("\\", "\\\\", $_POST['onderwerp'])); // Slashes van quotes
  
  if (mail($mail_ontv, $_POST['onderwerp'], $inhoud_mail, $headers))
  {
      // zorg ervoor dat dezelfde persoon niet kan spammen
      $_SESSION['antiflood'] = time();
      
      echo '<h1>Het contactformulier is verzonden</h1>
      
      <p>Bedankt voor het invullen van het contactformulier. We zullen zo spoedig mogelijk contact met u opnemen.</p>';
  }
  else
  {
      echo '<h1>Het contactformulier is niet verzonden</h1>
      
      <p><b>Onze excuses.</b> Het contactformulier kon niet verzonden worden.</p>';
  }
}
?>


[AngelinaBelle]

That part of the code is expected to be executed even if that value is empty

if 
( 
 ($_SERVER['REQUEST_METHOD'] == 'POST' && 
  (
   !empty($antiflood) || empty($_POST['naam']) 
   || !empty($naam_fout) || empty($_POST['mail']) 
   || !empty($email_fout) || empty($_POST['bericht']) 
   || empty($_POST['onderwerp'])
  )
 ) 
 || $_SERVER['REQUEST_METHOD'] == 'GET'
)

So I would think the code would be prepared for it to be unset.
 

Code: (find) [Select]

htmlspecialchars($_POST['bericht'])


Code: (replace) [Select]

( empty($_POST['bericht']) ? '' :  htmlspecialchars($_POST['bericht']) )
And so on for the other values that just might be empty.
 
HOWEVER:  If this code did not give the original author any problems, then it is probably expecting something different from what it is getting. It seems to expect that value to be set, even if it is completely blank.  You may be using this form differently than it was intended to be used, and so you might run into other problems, as well.
 
It might be a good idea to contact the author.

[willemjan]

Code: (find) [Select]

htmlspecialchars($_POST['bericht'])


Code: (replace) [Select]

( empty($_POST['bericht']) ? '' :  htmlspecialchars($_POST['bericht']) )


This actually worked. I did this for all of the errors, and they are gone now. I emptied my errorlog and tried a few times. The mail also gets sent. I also deleted the sessionstart out of the script. That caused errors two...

I actually don't understand why it works, but it does.

Thanks allot for your help!! 

[AngelinaBelle]

Yes -- session_start should not be necessary, as SMF starts the session itself.
 
http://php.net
http://w3schools.com/php