Welcome to eformmail. This program is a secure and safe solution to emailing the contents of a form to an email address.
The latest version is always available at: http://www.pobox.com/~berend/eformmail/.
Table of Contents:
The task: you want the persons who visit your site be able to give comments or feedback.
The problem: but as soon as you put an email address on your web page, email address harvesters wil come and start spamming that email address. This turns away many volunteers, because if you put their email address on a web page, they will get inundated with spam.
non-solution: instead of just providing an email address, the web page has a nice HTML form. Visitors fill this in and press a submit button. No email address shown, right? Not necessarily true. Popular programs currently in use, such as formmail, still require the email address to be there. It might not be visible to visitors, but automated email harvesters can easily extract it. You still have to put the email address on the form as a hidden field. But hidden is hidden for visitors, not for programs.
solution: eformmail requires no email address whatsoever to be present on the form. eformmail is a program which can gather and send the contents of any HTML form to an email address. The email address is not buried in the form, but remains hidden on the hosting server. It will never be revealed in any form to the outside world whatsoever.
You're a seasoned web master? Here the quick guide.
cp eformmail.cgi /var/www/cgi-bin/do_not_use_this_name.cgiNote: certain installations require that your cgi program is owned by a certain user.
That's it. eformmail.cgi is now fully set up. If there are error messages, look in the error log file of your web server. For Apache this is usually /var/log/httpd/errorlog.
Spam is Internet's biggest problem. If you put an email address on a web page, email address harvesters will come and use that email address to send spam to. Even if you put that email address in a hidden form field. That's no protection at all.
So eformmail does not need an email address in the form. Instead you put a key in the form. That key is read and used to lookup the email address. The email address resides safe on your server and is not accessible to the world.
Individual fields can be validated with special spam trap validation. If the field contents matches this, the submission is considered to be from a spammer and silently discarded. The spammer is not told this happens, so he cannot finetune his delivery method.
The validation is usally very simple. The spammer always tries to send a url, something in the form of http://www.viagra-here.com. Simply checking if an address field does not contain a url is usually sufficient to catch all spam.
To do this, simply use the spam keyword in the key configuration file. Example:
spam address = /http:\/\//
Other programs that can mail the contents of a form call themselves universal form to email gateways. Spammers did like that. They used it as an open relay tool to send email to everyone in the universe
eformmail is secure and safe and cannot be used to mail just anyone. It can only be used to the email address that is specified for that form.
eformmail can still be misused. Spammers could fill in the form with spam information and press the "Submit" button. That is unavoidably if the form is open to everyone in the world. Everyone includes spammers. But see how spammers can be identified in most cases.
However, eformmail has taken the following precautions that make it hard for spammers to detect sites that use eformmail:
The main configuration file is equal to the name of the program plus the .conf extension. So if you have named the program save_it, the configuration file is save_it.conf. The program looks for this configuration file in the following directories, in this order:
The configuration file contains the following pieces of information:
An example configuration file is:
# Main configuration file for eformmail. # The "key field name" should list the field name in the form that # contains the key. The value of this field is used to lookup another # configuration file which contains the email address. # eformmail will redirect the user to the "error redirect" page if this # key does not exist in the passed form data. key field name = key # The page to redirect browsers to when the key field was not present. # If the key field is not present, this indicates an error in creating # the form or an attempt by spammers to misuse eformmail. # The page to redirect to should be as general as possible and # certainly not tell what field is the key field as spammers can use # that information. # The contents of this field must be a full URL, a partial reference # will not work. error redirect = http://localhost/main_error.html # Optionally can specify the location of sendmail (or a clone like # postfix). # If no location is specified, eformmail will try to find sendmail in # certain well-known paths. # # The -i and -t parameters are required for sendmail! #sendmail = /usr/sbin/sendmail -i -t
Every form must contain a key. What field constitues the key field is in the main configuration file. When the key is found in the form, eformmail looks for another configuration file. The name of that file is the value of the key field plus the extension .conf. eformmail looks for that file in the same directory where the main configuration file is found.
Assume that the key is name and assume that the contents of this form field is "info". eformmail will look for a configuration file of the name info.conf.
Because eformmail uses the content of the key field to create a file name, the contents of the key field should consist of characters that make a valid file name. Else you won't be able to create that configuration file. Spaces and such are fine, but if the contents of the key field could be something like "this | is > not < a good filename", choose another key.
The key configuration file contains the following items:
# Key configuration file for eformmail. # Where must contents of form be sent to? # Contents of this field is copied straight to the To field of the email. # This is a required field. to = firstname.lastname@example.org # In case the form contains a field where users can supply an email # address, list that field here. # The contents of that field will be used in the From field of the email. from field name = from # In case users don't have to supply an email address or when the # email address is empty, use the contents of this field for the From # header field of the email. # This is a required field. from = feedback@localhost # In case the form contains a field which can be used as the subject # of the email message, list that field here. # The contents of that field will be used in the Subject field of the email. subject field name = subject # If subject prefix is set, it is prepended to the subject. # This helps to identify messages send by eformmail. subject prefix = [feedback] # In case the form does not contain a subject, or if the subject is # left empty, the contents of the following field is used in the # Subject field of the email. # This is a required field. subject = (No Subject) # Transformation of the body. Input is XML, so the transformation is # probably an XSLT processor. The current directory is the eformmail # directory, so style sheets do not have to be prefixed with the full # path. # It is considered an error if the program exits with any error code # then 0. #transform = /usr/local/bin/Xalan - test.xsl # Form fields can be validated as well. # A validation line is of the form: # validate [field name] = type | /regular-expression/ # # Recognized types are: double, email, integer, nonNegativeInteger, url # # Examples: # validate from = email # # Or # # validate number = /[0-9]+/ # validate from = email #validate subject = /.+/ # Spam protection: any submission where a field matches the provided # regular expression, will be silently ignored. The spammer will be # given no indication that his submission has appeared in a black # hole. spam subject = /http:\/\// # If sending the email was successful, the user is redirect to this page. # The contents of this field must be a full URL, a partial reference # will not work. success redirect = http://localhost/success.html # If any other error occurs (for example the email could not be sent) # the user is redirect to this page. # The contents of this field must be a full URL, a partial reference # will not work. error redirect = http://localhost/key_error.html
If all has been setup, you can adapt or create an HTML form. The action of the form should refer to the location of your eformmail.cgi program. The method should be "post". Both the application/x-www-form-urlencoded and multipart/form-data encodings are supported. eformmail.cgi shouldn't be used yet to email binary files. They probably have to be sent as attachments to the email. This is scheduled for a future release.
<html xmlns="http://www.w3.org/1999/xhtml" lang="en" xml:lang="en"> <head> <title>Test form</title> </head> <body> <h1>Example form</h1> <form method="post" action="/cgi-bin/do_not_use_this_name.cgi"> <p><input type="hidden" name="key" value="berend"/> <label for="from">From: </label><input name="from"/></p> <p><label for="subject">Subject: </label><input name="subject"/></p> <p><label for="subject">Message: </label><textarea name="body" rows="10" cols="60"/></p> <p><button name="Submit">Submit</button></p> </form> </body> </html>
It will look like this:
The email message that is sent, looks like this if no transformation is specified:
Date: Tue, 06 Apr 2004 09:46:45 +1200 Message-Id: <email@example.com> To: feedback@localhost From: firstname.lastname@example.org Subject: [feedback] A test X-Mailer: eformmail 0.3 MIME-Version: 1.0 Content-Length: 82 key: berend from: email@example.com subject: Error on your web page body: Could you please fix this? Submit:
This is the message that ends up in your log when a submission by a spammer is detected:
[Mon May 07 12:41:45 2007] [error] [client 127.0.0.1] Rejected form submission that looked like spam., referer: http://localhost/eformmail.cgi
That's all there is to setting up eformmail. I hope this program will be useful to you.