联系表格提交403 Forbidden Access

Question

I have the following html and php codes for my contact form. At first when website was uploaded live it worked. After a few days I noticed the contact form was giving 403 forbidden error on submit. I've changed the file permission to 755 and it worked for a short time and then went back to 403 forbidden. Not sure if something wrong with my php or html. Please help.

HTML Code:

<form action="email.php" method="post">
            <div class="col-md-12">
                <div class="row">
                    <div class="col-md-6">
                        <div class="form-group">
                            <input type="text" class="form-control" name="first-name" placeholder="First Name">
                        </div>
                    </div>
                    <div class="col-md-6">
                        <div class="form-group">
                            <input type="text" class="form-control" name="last-name" placeholder="Last Name">
                        </div>
                    </div>
                    <div class="col-md-6">
                        <div class="form-group">
                            <input type="text" class="form-control" name="email" placeholder="Email">
                        </div>
                    </div>
                    <div class="col-md-6">
                        <div class="form-group">
                            <input type="number" class="form-control" name="phone" placeholder="Phone">
                        </div>
                    </div>
                    <div class="col-md-12">
                        <div class="form-group">
                            <textarea name="message" class="form-control" id="" cols="30" rows="7" placeholder="Message"></textarea>
                        </div>
                    </div>
                    <div class="col-md-12">
                        <div class="form-group">
                            <input type="submit" value="Send Message" class="btn btn-primary">
                        </div>
                    </div>
                </div>
            </div>
            </form>

PHP Code:

<?php 
$firstname = $_POST['first-name'];
$lastname = $_POST['last-name'];
$email = $_POST['email'];
$phone = $_POST['phone'];
$message = $_POST['message'];
$formcontent="From: $firstname $lastname 
 Email: $email 
 Phone: $phone 

 Message: $message";
$recipient = "[e-mail]";
$subject = "Contact Form from $firstname $lastname";
$mailheader = "From: $firstname $lastname $email 
";
mail($recipient, $subject, $formcontent, $mailheader) or die("Error!");
echo' 
<script>
window.onload = function() {
    alert("Thank You for reaching out to us!");
    location.href = "contact.html";
}
</script>
';
?>

Answer 1

10.4.4 403 Forbidden

The server understood the request, but is refusing to fulfill it. Authorization will not help and the request SHOULD NOT be repeated. If the request method was not HEAD and the server wishes to make public why the request has not been fulfilled, it SHOULD describe the reason for the refusal in the entity. If the server does not wish to make this information available to the client, the status code 404 (Not Found) can be used instead.

The disclaimer seems to contain several HTML tags and they apparently get printed unescaped on the page.

My wild guess is that there's a piece of software installed on the server (possibly mod_security) that rejects the input because it considers it's an attempt to perform a XSS attack. You can confirm (or reject) this hypothesis by temporarily removing the < and > symbols before pasting it into the textarea.