[cenutrio]

I'm having trouble creating a web form for my web site. I was trying to make it using RapidWeaver, but I failing miserably at it (document, server kind of trouble). Anyhow, I gave up and learnt how to write a bit of html and created a emailto html form.

Later I learnt that such forms are unreliable, and also I do not like that (1) data output is confusing (with the &..&.., etc), and (2) it actually has to be emailed by the customer, so in case of non-functional email software in the computer, all this is not possible. So, I'm back with RW.

My major problem is that when I get the forms published, and place them via ftp in another site (www.tonirivas.com), for wherever reason it doesn't actually work. The form document is a php and I'm not used to this. BTW, my server is .php compatible (startlogic.com).

So another my question for those who have to deal with this kind of things, how would you do it, I have checked for online form providing services, but I rather rely on the macnn community advice in case I go this way. Just let me know,

Thanks

[Big Mac]

You have to use some sort of forms processor and make sure your paths to it are correct. I know, it can be a pain in the rear. Starlogic support may be able to help you.

[besson3c]

You need far more than just display HTML, that is the easy part...

At the form processing level you need proper error checking both for the benefit of ensuring that legitimate users enter legitimate data, but also quite importantly for security reasons. Take a web security 101 course, and the first thing you'll learn is that poorly designed forms are the target for a great amount of crap - primarily as a means of sending spam, but also sometimes as a means of compromising your site.

Form processing is handled by a middleware language such as PHP, Perl, Coldfusion, etc. Since you're using PHP, are you writing your own form processing engine or stealing somebody else's?

In order for this form to email output to you, the form processing script will need to direct output accordingly, and the server will have to be configured to send mail. In some cases this means mail being sent (and not queued) from the web server, in others it means relaying to a mail server. Unless you run this server, the mail configuration part is not a problem you have to worry about outside of knowing that the envelope address for messages sent from your form will be set respectfully, and that this may effect what sort of spam score is assigned to these messages.

If all of this is over your head, I would strongly suggest learning this as quickly as you can. Having a badly designed web form that has the ability to do something destructive (which includes sending mail somewhere) should be avoided at all costs.

Let me know if you'd like some help with your form error checking. Here's a hint: spammers often like to try using the ASCII backspace character in the body of the message to modify the destination address for your form.

[Big Mac]

Hosting providers usually have at least one forms processing script built-in. Otherwise, you can search online. This looks like good software: Free FormMail, Form Encryption

[besson3c]

The other thing is that if this form is to be used for mass mailing, it needs to be designed a very particular way as to assure properly delivery of mail and not create a load spike on the server.

[besson3c]

Originally Posted by Big Mac 

Hosting providers usually have at least one forms processing script built-in. Otherwise, you can search online. This looks like good software: Free FormMail, Form Encryption

I wouldn't recommend somebody else's form processor actually... Form processing literally involves just a few lines of code, and by the time you customize the error checking provided in somebody else's form processing engine for your own form you could have just whipped up something yourself.

Error checking should include:

- checks that all required fields have been filled in (don't rely on Javascript for this, as search engines and spam bots do not understand Javascript)

- assurances that the to address is identical to a hard coded value, or that there is only x number of addresses

- assurances that the to address is set to a particular domain

- assurances that the email address is valid

- assurances that input from any other fields are valid

- in some cases it is smart to put a limit on the number of characters accepted in the body of the message


This sort of pattern matching is commonly done via regular expressions... Something like /^.+?@.+?\.(com|net|org|edu)$/ will match an email address with a .com/net/org/edu suffix.

[Big Mac]

I think you're overestimating the non-professional coder's ability to create custom forms processing. Besides, why reinvent the wheel if free solutions do it better?

[TETENAL]

That's why most web hosters offer a script kit with stuff like e-mail forms, forums etc. Just use that.

[besson3c]

Perhaps you guys are right, but where I work there have been a number of sites that have been burnt quite badly by a badly configured form, so if nothing else I think it's good to try to understand these issues as best as you can rather than blindly trusting a piece of software or setting something up without really understanding what you are doing.

[Peter]

Online HTML Form Builder Software - Create Free Forms & Surveys

[cenutrio]

Thanks guys,

That wuffo surely looks cool and seems to work just fine, a bit pricey though... (just my opinion)

[Peter]

the free form seemed ok to me?

[cenutrio]

ok, i set it up to work just fine. But that wuffo service may be very tempting, a stylish short-cut in the future.

Thanks you all