How can you improve the script in terms of security. I want to filter the input value. Now the script accepts everything, but only the phone needs + 7 and 10 digits

<? php $getFood = $_GET['food']; $getPhone = $_GET['phone']; require 'mail/PHPMailerAutoload.php'; $userName = ""; $userPass = ""; $userInfo = ''; $sendTo = ''; $sendToInfo = '!!!'; date_default_timezone_set('Etc/UTC'); $mail = new PHPMailer; $mail - > isSMTP(); $mail - > SMTPDebug = 2; $mail - > Debugoutput = 'html'; $mail - > Host = 'smtp.gmail.com'; $mail - > Port = 587; $mail - > SMTPSecure = 'tls'; $mail - > SMTPAuth = true; $mail - > Username = $userName; $mail - > Password = $userPass; $mail - > setFrom($userName, $userInfo); $mail - > addReplyTo($userName, $userInfo); $mail - > CharSet = 'UTF-8'; if (!empty($_GET['phone'])) { if (empty($_GET['food'])) { $mailSubject = 'Перезвоните клиенту'; $mailText = "Номер телефона: <b>".$getPhone. '</b><br>'; } else { $mailSubject = 'Новый заказ на доставку'; $mailText = '<h1>Новая заявка на доставку!</h1>Номер телефона: <b>'.$_GET['phone']. '</b><br>Блюдо: <b>'.$_GET['food']. '</b>'; echo $mailText; } $mail - > addAddress($sendTo, $sendToInfo); $mail - > Subject = $mailSubject; $mail - > msgHTML($mailText, dirname(__FILE__)); if (!$mail - > send()) { echo "Mailer Error: ".$mail - > ErrorInfo; } else { echo "Message sent!"; } } else echo "No callback";

  • one
    it would be better to check the user's javascript right away - Jean-Claude
  • 2
    @ Jean-Claude Even if you check on the user side, you still need to check on the server. - Arnial

1 answer 1

You can use preg_match for regular check.

 if (!empty($_GET['phone']) && preg_match("/\+\d{10}/", $_GET['phone'])) { ... } else echo "No Callback"

upd: To make sure that the line includes only the phone number, add the beginning (^) and end ($) characters to the regular expression:

 "/^\+\d{10}$/"