This function will allow you to validate whether the submission is coming from your site, and if it has code in the $_POST fields (optional)



<?php

// By Jordan S. C. Thompson
// Some help by Velox Letum

// This script will check to make sure the submission
// is coming from your site, and that no code is
// found in the post fields.


function validateFormSubmission($noCodeCheck = FALSE) {
if(isset($_POST)) {
$runningScriptOn = "http://".$_SERVER['HTTP_HOST']."/";
$referParts = parse_url($_SERVER['HTTP_REFERER']);
if(empty($referParts['scheme'])) {
$scheme = "http://";
} else {
$scheme = $referParts['scheme'];
}
$host = $referParts['host'];
$referRunningOn = $scheme . $host;
if($referRunningOn !== $runningScriptOn) {
$die = 1;
}
if($noCodeCheck == FALSE) {
foreach($_POST as $key => $val) {
if(strlen($val) != strlen(strip_tags($val)){
$die++;
}
}
}
if($die == 1) {
die("There was a problem with the form submission.");
} elseif($die == 2) {
die("There was more the one problem with the form submission.");
} else {
return true;
}
} else {
return true;
}
}

?>


Here is an example of using it:



<?php
// This is at the top of my doument, under where you would include or place the function.

// Example one, check refer and for code
validateFormSubmission();

// Example two, check refer, but don't check for code
validateFormSubmission(TRUE);

?>


If you want to use this else where in the file, and don't want it to die and kill your template then replace:



// Original Code
if($die == 1) {
die("There was a problem with the form submission.");
} elseif($die == 2) {
die("There was more the one problem with the form submission.");
} else {


With:



// Replacement Code
if(isset($die)) {
return false;
} else {


I hope this is usefull. :)