From a9222141c1d25adf3d9e6382ff4a0e15b8e3ca12 Mon Sep 17 00:00:00 2001
From: David Miller <hello@davidmiller.io>
Date: Tue, 9 Feb 2016 13:33:08 -0500
Subject: [PATCH] add some security to mail script

---
 mail/contact_me.php | 30 +++++++++++++++---------------
 1 file changed, 15 insertions(+), 15 deletions(-)

diff --git a/mail/contact_me.php b/mail/contact_me.php
index e950b6e..9770270 100644
--- a/mail/contact_me.php
+++ b/mail/contact_me.php
@@ -1,26 +1,26 @@
 <?php
 // Check for empty fields
-if(empty($_POST['name'])  		||
-   empty($_POST['email']) 		||
-   empty($_POST['phone']) 		||
-   empty($_POST['message'])	||
+if(empty($_POST['name'])      ||
+   empty($_POST['email'])     ||
+   empty($_POST['phone'])     ||
+   empty($_POST['message'])   ||
    !filter_var($_POST['email'],FILTER_VALIDATE_EMAIL))
    {
-	echo "No arguments Provided!";
-	return false;
+   echo "No arguments Provided!";
+   return false;
    }
-	
-$name = $_POST['name'];
-$email_address = $_POST['email'];
-$phone = $_POST['phone'];
-$message = $_POST['message'];
-	
+   
+$name = strip_tags(htmlspecialchars($_POST['name']));
+$email_address = strip_tags(htmlspecialchars($_POST['email']));
+$phone = strip_tags(htmlspecialchars($_POST['phone']));
+$message = strip_tags(htmlspecialchars($_POST['message']));
+   
 // Create the email and send the message
 $to = 'yourname@yourdomain.com'; // Add your email address inbetween the '' replacing yourname@yourdomain.com - This is where the form will send a message to.
 $email_subject = "Website Contact Form:  $name";
 $email_body = "You have received a new message from your website contact form.\n\n"."Here are the details:\n\nName: $name\n\nEmail: $email_address\n\nPhone: $phone\n\nMessage:\n$message";
 $headers = "From: noreply@yourdomain.com\n"; // This is the email address the generated message will be from. We recommend using something like noreply@yourdomain.com.
-$headers .= "Reply-To: $email_address";	
+$headers .= "Reply-To: $email_address";   
 mail($to,$email_subject,$email_body,$headers);
-return true;			
-?>
\ No newline at end of file
+return true;         
+?>