Form Handlers

Inspirations

• http://www.enformed.io/setup
• https://github.com/formspree/formspree

Form Action Attribute

The action attribute contains the email address to which summaries of the form submissions are sent.

<form action="https://url.tld/email@address.tld"></form>

Hidden Configuration Fields

Various other configuration options are set in hidden fields.

<form action="https://url.tld/email@address.tld">
    <input type="hidden" name="*..." value="...">
    ...
</form>

*bcc <email address[es]>

Send a copy of the email to this address, but don't mention it in emails sent to other addresses

*cc <email address[es]>

Send a copy of the email to this address

*debug <truthy|falsy>

If a truthy value, no email is sent and instead the content of the email is shown in the browser along with other useful information

*formname <string>

Helps organize and identify submissions when looking at stored submissions in the database

*gotcha or *honeypot <anything>

If any value, the submission is rejected

*redirect <URL>

Following a successful submission, the submitter will be sent to this URL. This must be an actual URL, not just something you think is a URL, because it's run through filter_var with FILTER_VALIDATE_URL.

*replyto <email address>

All emails come from the PHP default, but replies will be sent to this address instead

*subject <string>

The subject line of the email

*to <string>

The address to which a form summary will be sent

Recommendations

• Do not use checkbox fields in your form
  • Only values of ticked checkboxes are transmitted
  • Avoidance is the easiest mitigation

Future Plans

• New field *honeypotname
  • The name of a field that is a honeypot
  • Submissions with values in that field are rejected
• New field *from
  • Set the from header
  • Currently the PHP default is used
• New Field *thanksmessage
  • The text that will appear on the thanks page