). */ $config = [ 'to' => 'you@example.com', // who receives the messages: change this 'from' => 'lien.heywang@gmail.com', // an address on your own domain 'subject' => 'New message from the Salvation website', 'honeypot' => 'website', 'fields' => [ // contact.html: name, email, subject, message; blog-single.html (comments): name, email, url, message 'name' => ['label' => 'Name', 'required' => true, 'type' => 'text'], 'email' => ['label' => 'Email', 'required' => true, 'type' => 'email'], 'subject' => ['label' => 'Subject', 'required' => false, 'type' => 'text', 'subject' => true], 'url' => ['label' => 'Website', 'required' => false, 'type' => 'text'], 'message' => ['label' => 'Message', 'required' => true, 'type' => 'textarea'], ], 'max_length' => 5000, // per field, in characters ]; // --------------------------------------------------------------------------------------------- $is_ajax = strtolower($_SERVER['HTTP_X_REQUESTED_WITH'] ?? '') === 'fetch' || strtolower($_SERVER['HTTP_X_REQUESTED_WITH'] ?? '') === 'xmlhttprequest'; function respond($text, $is_ajax, $ok = false) { if ($is_ajax) { header('Content-Type: text/plain; charset=UTF-8'); echo $text; } else { header('Content-Type: text/html; charset=UTF-8'); $msg = $ok ? 'Thank you, your message has been sent.' : htmlspecialchars($text, ENT_QUOTES, 'UTF-8'); $back = htmlspecialchars($_SERVER['HTTP_REFERER'] ?? '/', ENT_QUOTES, 'UTF-8'); echo '' . '' . ($ok ? 'Message sent' : 'Message not sent') . '' . '' . '

' . $msg . '

Back to the site

'; } exit; } if ($_SERVER['REQUEST_METHOD'] !== 'POST') { http_response_code(405); header('Allow: POST'); exit; } // Bots fill every input; people never see this one. if ($config['honeypot'] !== '' && trim((string) ($_POST[$config['honeypot']] ?? '')) !== '') { respond('OK', $is_ajax, true); // pretend success, send nothing } $values = []; $missing = []; $reply_to = ''; $subject = $config['subject']; foreach ($config['fields'] as $key => $field) { $raw = (string) ($_POST[$key] ?? ''); $type = $field['type'] ?? 'text'; $raw = function_exists('mb_substr') ? mb_substr($raw, 0, $config['max_length'], 'UTF-8') : substr($raw, 0, $config['max_length']); // One line only, except textareas: a CR or LF in a header field would let a visitor add headers. $value = $type === 'textarea' ? trim($raw) : trim(str_replace(["\r", "\n"], ' ', $raw)); if ($value === '') { if (!empty($field['required'])) $missing[] = $field['label'] ?? $key; continue; } if ($type === 'email') { if (!filter_var($value, FILTER_VALIDATE_EMAIL)) { $missing[] = 'a valid ' . strtolower($field['label'] ?? 'email address'); continue; } if ($reply_to === '') $reply_to = $value; } if (!empty($field['subject'])) $subject = $value; $values[$key] = $value; } if ($missing) { respond('Please fill in ' . implode(', ', array_unique($missing)) . '.', $is_ajax); } $esc = function ($s) { return htmlspecialchars($s, ENT_QUOTES, 'UTF-8'); }; $host = $esc($_SERVER['SERVER_NAME'] ?? 'your site'); $rows = ''; foreach ($values as $key => $value) { $label = $esc($config['fields'][$key]['label'] ?? $key); $shown = ($config['fields'][$key]['type'] ?? 'text') === 'textarea' ? nl2br($esc($value)) : $esc($value); $rows .= '' . $label . '' . $shown . ''; } $body = '' . $rows . '
' . '

Sent from the form on ' . $host . '.

'; $headers = [ 'From: ' . $config['from'], 'MIME-Version: 1.0', 'Content-Type: text/html; charset=UTF-8', ]; if ($reply_to !== '') $headers[] = 'Reply-To: ' . $reply_to; $sent = mail($config['to'], '=?UTF-8?B?' . base64_encode($subject) . '?=', $body, implode("\r\n", $headers)); $sent ? respond('OK', $is_ajax, true) : respond('Something went wrong. Please try again.', $is_ajax);