使表单处理脚本更安全

Question

what are some steps I can use to make this more secure?

<?php
foreach ($_POST as $field=>$value)
{
$formcontent .= "$field: $value
";
}
$formcontent .= 'User-Agent: '.$_SERVER['HTTP_USER_AGENT'];


$recipient = "****.***y@***********.co.uk";
$subject = "Event feedback form";
$mailheader = "From: web.form@**********.co.uk
";
$mailheader .= "Reply-To: $email
";
$mailheader .= "MIME-Version: 1.0
";


mail($recipient, $subject, $formcontent, $mailheader) or die("Failure!");
header("location:http://www.**********.co.uk");
?>

Answer 1

You may want to apply htmlentities to $value to prevent cross site scripting.

$formcontent .= "$field: " . htmlentites($value) . "
";

Otherwise, its okay, as your values don't go into DB.