FormMail.pl

<?php
// PHP Form Handler with security measures

$allowed_recipients = ['[email protected]', '[email protected]'];
$allowed_domains = ['yourdomain.com', 'www.yourdomain.com'];

// CSRF check
session_start();
if ($_POST['csrf_token'] !== $_SESSION['csrf_token']) {
    die('Invalid CSRF token');
}

// Validate referer
$referer = parse_url($_SERVER['HTTP_REFERER'] ?? '', PHP_URL_HOST);
if (!in_array($referer, $allowed_domains)) {
    die('Invalid referer');
}

// Sanitize inputs
$recipient = filter_var($_POST['recipient'] ?? '', FILTER_SANITIZE_EMAIL);
$subject = htmlspecialchars($_POST['subject'] ?? 'Form Submission', ENT_QUOTES, 'UTF-8');
$redirect = filter_var($_POST['redirect'] ?? '', FILTER_SANITIZE_URL);

// Validate recipient against whitelist
if (!in_array(strtolower($recipient), array_map('strtolower', $allowed_recipients))) {
    die('Invalid recipient');
}
if (!filter_var($recipient, FILTER_VALIDATE_EMAIL)) {
    die('Invalid email format');
}

// Build message body
$message = "Form submission received:\n\n";
$excluded = ['recipient', 'subject', 'redirect', 'csrf_token'];

foreach ($_POST as $key => $value) {
    if (in_array($key, $excluded)) continue;
    $clean_key = htmlspecialchars($key, ENT_QUOTES, 'UTF-8');
    $clean_value = htmlspecialchars($value, ENT_QUOTES, 'UTF-8');
    $message .= "$clean_key: $clean_value\n";
}
$message .= "\n--- Environment ---\n";
$message .= "IP: " . $_SERVER['REMOTE_ADDR'] . "\n";
$message .= "User Agent: " . $_SERVER['HTTP_USER_AGENT'] . "\n";

// Send
$headers = [
    'From: [email protected]',
    'Reply-To: ' . ($_POST['email'] ?? '[email protected]'),
    'Content-Type: text/plain; charset=UTF-8'
];

if (mail($recipient, $subject, $message, implode("\r\n", $headers))) {
    if ($redirect) {
        header("Location: $redirect");
        exit;
    }
    echo "<h1>Thank You</h1><p>Your message has been sent.</p>";
} else {
    echo "<h1>Error</h1><p>Failed to send message.</p>";
}

// Node.js/Express form handler
const express = require('express');
const nodemailer = require('nodemailer');
const helmet = require('helmet');
const rateLimit = require('express-rate-limit');

const app = express();
app.use(helmet());
app.use(express.urlencoded({ extended: true }));

const limiter = rateLimit({
    windowMs: 15 * 60 * 1000, // 15 minutes
    max: 10
});

const ALLOWED_RECIPIENTS = ['[email protected]'];
const ALLOWED_DOMAINS = ['yourdomain.com'];

const transporter = nodemailer.createTransport({
    host: 'smtp.yourdomain.com',
    port: 587,
    auth: {
        user: process.env.SMTP_USER,
        pass: process.env.SMTP_PASS
    }
});

app.post('/contact', limiter, async (req, res) => {
    try {
        const { recipient, subject, redirect, ...formData } = req.body;

        // Validate referer
        const referer = new URL(req.headers.referer || '').hostname;
        if (!ALLOWED_DOMAINS.includes(referer)) {
            return res.status(403).send('Invalid referer');
        }

        // Validate recipient against whitelist
        if (!ALLOWED_RECIPIENTS.includes(recipient?.toLowerCase())) {
            return res.status(400).send('Invalid recipient');
        }

        // Build message
        let message = 'Form submission:\n\n';
        for (const [key, value] of Object.entries(formData)) {
            message += `${key}: ${value}\n`;
        }
        message += `\nIP: ${req.ip}\nUser Agent: ${req.headers['user-agent']}\n`;

        await transporter.sendMail({
            from: '[email protected]',
            to: recipient,
            subject: subject || 'Form Submission',
            text: message
        });

        redirect ? res.redirect(redirect) : res.send('Message sent.');
    } catch (error) {
        console.error(error);
        res.status(500).send('Error sending message');
    }
});

app.listen(3000);