Date: 12/17/05 (PHP Community)    Keywords: spam

So, what am I still missing? 'Cause apparently spam was still getting through, so they shut down the contact processing script at my host.

First off, I secured the script in a folder protected by .htaccess requiring the user to use the "guest" method of logging in.

I added the checks suggested here. What lack I yet?

]*?>.*?@si', // Strip out javascript
 '@<[\/\!]*?[^<>]*?>@si', // Strip out HTML tags
 '@([\r\n])[\s]+@', // Strip out white space
 '@&(quot|#34);@i', // Replace HTML entities
 '@&(amp|#38);@i',
 '@&(lt|#60);@i',
 '@&(gt|#62);@i',
 '@&(nbsp|#160);@i',
 '@&(iexcl|#161);@i',
 '@&(cent|#162);@i',
 '@&(pound|#163);@i',
 '@&(copy|#169);@i',
 '@&#(\d+);@e');
 $replacewith=array('',
 '',
 '\1',
 '"',
 '&',
 '<',
 '>',
 ' ',
 chr(161),
 chr(162),
 chr(163),
 chr(169),
 'chr(\1)');
 $formfield=preg_replace($toclean,$replacewith,$formfield);
 return $formfield;
}


if (!empty($HTTP_POST_VARS)){
 //Set up variables
 $now = date( "D dS M h:m:s" ); // Set these variables according to your details 
 $toAddress = "bii@biistate.net" ;
 $redirect = "contactconfirm.php"; 
 $subject = "Contact Message from BII Website" ;
 
 $formEmail = cleanitup(trim($HTTP_POST_VARS['youremail']));
 $formName = cleanitup(trim($HTTP_POST_VARS['yourname']));
 $formOrg = cleanitup(trim($HTTP_POST_VARS['yourorganization']));
 $formMessage = cleanitup(trim($HTTP_POST_VARS['comment']));
 
 if (eregi("\r",$formEmail) || eregi("\n",$formEmail)){
 die("Why ?? :(");
 }
 
 
 //Check to make sure there's only one email address and nothing else in the email form field.
 if (ereg('^([a-zA-Z0-9])+([\.a-zA-Z0-9_-])*@([a-zA-Z0-9_-])+(\.[a-zA-Z0-9_-]+)*\.([a-zA-Z]{2,4})$',$formEmail)) {
 // is good
 // Email message 
 $message ="\n\r";
 $message .= "Name: " .$formName. "\n" ;
 $message .= "Email: " .$formEmail. "\n" ;
 $message .= "IP Address: ".$REMOTE_ADDR. "\n";
 $message .= "Organization:" .$formOrg. "\n" ;
 $message .= "Comments:\n" ;
 $message .= $formMessage. "\n" ;

 $headers="From: \"".$formName."\" <".$formEmail.">\n";

 $bMailSent = mail($toAddress, $subject, $message, $headers);
 if (!$bMailSent){ 
 echo "Unable to send email"; 
 } 
 else { header("Location: $redirect"); }
 }
 else{
 die('This appears to be spam and will not be sent. Go away.');
 }
 
}


?> 

Source: http://www.livejournal.com/community/php/380498.html