@Ryan - Yep, the dreaded globals is set to "Off"
@PMS - Thanks for replying to this post
It would be great to find somewhat more comprehensive tutorials for eForm.
As a non php’er its hard to realy understand what is meant with some of the technical specs found in the docs.
Reading the doc that PMS suggested I have understood to a point how to validate the form(s) before it actually can do any damage. The Badwords, GoodWords etc. jogged my memory - in Jot it can be called directly in the snippet call.
An example call for Jot:
[!Jot? &customfields=`name,email` &badwords=`{{Badwords}}` &bw=`2` &debug=`0` &validate=`name,email` &sortby=`createdon:d` &placeholders=`1` &output=`0` &pagination=`5` &captcha=`2`!]
In the code above you can see " &badwords=`{{Badwords}}` " which calls a chunk of words seperated with a comma.
An example eForm call (at least how I interpret the call):
[!eForm? &formid=`Test Form` &to=`{{my_mailaddress_chunk}}` &tpl=`testform` &report=`testform_report` &mailselector=`department` &vericode=`1` &sendAsHtml=`0` &allowhtml=`0` &subject=`[+subject+]`!]
In the call there is
&allowhtml=`0` which I understand as: When eForm validates the form and finds HTML characters such as
<a href,
<script etc.. the form is not sent and shows an error message. So if someone is testing a form for XSS vulnerability by using HTML they wont get far.
The example form would/could be:
<?php ?>
<div id="mydiv"> [+validationmessage+]
<p>All Fields Are Required!</p>
<form method="post" action="[~[*id*]~]">
<input type="hidden" name="formid" value="Test Form" />
<input type="hidden" name="sent_on" id="sent_on" value="<?php echo $modx->runSnippet("DateTime"); ?>" eform="Sent On:string:0"/>
<fieldset>
<div>
<label for="name">Name:</label>
<input type="text" name="name" id="name" eform="Name:string:1:#FILTER #EVAL return myFunction($functionname);"/>
</div>
<div>
<label for="email">Email:</label>
<input type="text" name="email" id="email" eform="Email:string:1:#FILTER #EVAL return myFunction($functionname);"/>
</div>
<div>
<label for="subject">Subject:</label>
<input type="text" name="subject" id="subject" eform="Email:string:1:#FILTER #EVAL return myFunction($functionname);"/>
</div>
<div>
<label for="message">Message:</label>
<textarea name="message" cols="25" rows="6" id="message" eform="Message:string:1:#FILTER #EVAL return myFunction($functionname);"></textarea>
</div>
<div><img src="[+verimageurl+]" alt="vericode" /> <input name="vericode" type="text" size="10" /> Enter here</div>
<div>
<input class="button" name="submit" type="submit" value="Submit" />
</div>
</fieldset>
</form>
</div>
<?php ?>
Is it possible to call the Badwords function directly in the snippet call in eForm instead of having to add " #FILTER #EVAL return myFunction($functionname); " in each and every input element (as shown above).
MODX Staff
) e.g