FormMail modification?

[ben456]

I have a page that uses a server-side cgi FormMail script, (a Matt's script clone), to email a form to a number of email addresses listed in a hidden Recipients field.

Is there any way it would be possible to modify it at page level so that if a checkbox is ticked then it adds another email address to the Recipient list.

Thanks in anticipation,
Ben

[Mr Cgi Guy]

maybe yes maybe no. would have to see the script. how about a link?

[ben456]

I guess a link would be helpful! The form is at http://www.housesnz.co.nz/form09.html. I am trying to modify it so that when a visitor clicks on the Mortgage checkbox at the bottom, it adds another email address to the recepient list.

Thanks,
Ben

[jeffmott]

Security Focus put MSA FormMail attacks third in their list of the Top Attacks for the 1st Quarter of 2002. Even Matt no longer recommends his scripts. Although the most popular, they are buggy and insecure.

Your list of recipients should be set in the script itself. You will need to test the checkbox value and modify your list of recipients in the script (not at the client level). You need to first find a different (better) script, and second upload it to a post so we can help you modify it to suit your needs.

[ben456]

Thanks for that but the script is one provided by my host so I have no access to or control over it. What (more secure) alternatives are there?

Thanks,
Ben

[jeffmott]

You may want to send a notice to your host then. Since the recipient list can be altered by users, the script can be used to send spam, threatening messages, etc. through the server that are usually untraceable except back to the site and/or host.

But until then this JavaScript will append a new address.

myForm.recipient.value += ", new@address.com";

[ben456]

Many thanks for this. I couldn't get it to work with the check boxes but got it working with Yes/No lists which is fine.

I will advise my host re the security issues of FormMail.

Thanks again for your help.

Ben

[celebguy_dv]

http://banners.dollarmachine.com/pic/2014000/hal001.gif