PHP mail script auto-runs same time every night

Question

I'm having an issue where my PHP mail code runs every night at like 11:30pm. I'm sure no one is clicking the form submission button. The email contents are empty.

In my PHP mail code, I add the contents to a database just in case the email does not go through, then send the email as well.

Thanks

Form:

<form action="background/mail.php" method="POST">
    <div class="row">
        <div class="six columns">
            <label>Your email</label>
            <input class="u-full-width" type="email" placeholder="example@validmail.com" name="email">
        </div>
        <div class="six columns">
            <label>Reason for contacting</label>
            <select class="u-full-width" name="reason">
                <option>Inquiry</option>
                <option>Order</option>
                <option>Other</option>
            </select>
        </div>
    </div>
    <div class="row">
        <div class="u-full-width">
            <label>Message</label>
            <textarea class="u-full-width" placeholder="Enter message here" name="message"></textarea>
          <input class="button-primary" type="submit" value="Submit">
        </div>
    </div>
</form>

mail.php:

<?php
    $to = "support@website.ca";
    $reason = "CUSTOMER MAIL: " . $_POST['reason'];
    $email = $_post['email'];
    $msg = $_POST['message'] . "\nemail: " . $email;
    $header = "MIME-Version: 1.0\r\n";
    $header.= "Content-type: text/html\r\n";
    $header.= "From: " . $email . "\r\n";
    $header.= "Reply-to: support@website.ca\r\n" . "X-Mailer: PHP/" . phpversion();

    require("login.php");

    $sql = "INSERT INTO emails (email, message, reason) VALUES ('$email','$msg','$reason')";

    if($conn->query($sql) === TRUE){
        mail($to,$reason,$msg, $header);
        echo "Added to database, mail sent.";
    } else {
        echo "Error: " . $sql . "<br>" . $conn->error;
    }

    $conn->close();

?>

Answer 1

Most likely someone is making POST requests directly to your mail script to send out emails. There are some non-fool-proof ways to stop this:

1. Add some checking for the contents of the POST request. e.g. no empty body, valid email address, other logical checking. (you should be doing this anyway).

2. Add an additional hidden field to your form that is empty. Confirm that it is empty in mail.php in order to proceed. The idea: crawlers try to fill all form fields, but a user won't fill in a hidden form field

3. Add a hidden field and fill it with some value using JS and validate in mail.php. Crawlers cant use Javascript so the field will be empty (gotcha: will not work for users that disable JS).

Any of these can be circumvented, but they are trivial to implement and make things slightly more difficult for the crawler.

For true security there are more complex solutions. Maybe someone can outline those in an answer.

Answer 2

As I stated in comments in having fallen victim to a bot (or many bots); here is what I use to block out certain IP addresses and used as an include in every file.

You should also check for empty() fields and use an isset() against a submit button.

The following doesn't need the last 4th set, but you can always add to it, as it checks for anything following the 3rd set.

You can even narrow it down to using only 2 sets.

$ip = $_SERVER['REMOTE_ADDR'];

$nums = explode(".", $ip);

$if = "{$nums[0]}.{$nums[1]}.{$nums[2]}";

$blacklist = array(

"184.154.139", 
"123.4.111", 
"234.5.678"

);

if (in_array($if, $blacklist)) {

// echo "Rejected";

header("Location: http://www.example.com/");
exit;

}

else { 

// Run your other code to do the variable check, mail processing etc.
}

I.e.:

Name your submit button:

<input name="submit" class="button-primary" type="submit" value="Submit">

Then check if it's set and that none of the POST arrays are (not) empty:

if(isset($_POST['submit'])){

    if(!empty($_POST['reason']) && !empty($_POST['email'])){

        $reason = $_POST['reason'];
        $email  = $_POST['email'];

        // Run your executables in here

    }
}

• Another effective method is to use a checkbox and to validate if it was checked or not.

---

Also as stated, your present code is open to SQL injection. Use prepared statements, or PDO with prepared statements.

Plus, that syntax error about $_post that I stated in comments, needs to be in uppercase $_POST as it's a superglobal.

• http://php.net/manual/en/language.variables.superglobals.php