PHP e-mail form with ReCAPTCHA

Question

I want to ask if you can review the code for a simple contact form and the PHP code which sends me an email once a visitor fills the form and is validated through Recaptcha

On my index.php file here are the form and php code

HTML:

<form id="contactform" action="index.php#contact" method="post" class="form" role="form">
 <div class="form-group">
 <input class="form-control required" id="vname" name="vname" placeholder="Your Name" type="text" required />
 </div>
 <div class="form-group">
 <input class="form-control required" id="vemail" name="vemail" placeholder="Your Email" type="email" required />
 </div>
 <div class="form-group">
 <textarea class="form-control required" id="msg" name="msg" placeholder="Your Message" rows="7" required></textarea>
 </div>
 <div class="form-group">
 <div class="g-recaptcha" data-sitekey="GOOGLE PUBLIC KEY"></div>
 </div>
 <div class="form-group">
 <input type="submit" class="btn btn-success form-send" value="Send">
 </div> 
</form>

PHP:

<?php
 $captcha;
 if (isset($_POST['g-recaptcha-response'])) { $captcha = $_POST['g-recaptcha-response']; }
 // Check for correct reCAPTCHA
 $response = file_get_contents("https://www.google.com/recaptcha/api/siteverify?secret=GOOGLE SECRET KEY&response=" . $captcha . "&remoteip=" . $_SERVER['REMOTE_ADDR']);
 if (!$captcha || $response.success == false) {
 echo "Your CAPTCHA response was wrong";
 exit ;
 } else {
 // Check for Blank Fields..
 if ($_POST["vname"] == "" || $_POST["vemail"] == "" || $_POST["msg"] == "") {
 echo "Please fill all required fields";
} else {
 // Check if the "Sender's Email" input field is filled out
 $email = $_POST['vemail'];
 // Sanitize E-mail Address
 $email = filter_var($email, FILTER_SANITIZE_EMAIL);
 // Validate E-mail Address
 $email = filter_var($email, FILTER_VALIDATE_EMAIL);
 if (!$email) {
 echo "Invalid Sender's Email";
 } else {
 $to = '[email protected]';
 $subject = 'New Form Entry';
 $message = "New message was submitted from <br /> " . "<strong>" . $_POST['vname'] . "</strong>" . "<br /><br />The message is:<br />" . "<strong>" . $_POST['msg'] . "</strong>";
 $headers = "From:" . $_POST['vname'] . "<" . $email . ">";
 $headers .= "MIME-Version: 1.0" . "\r\n";
 $headers .= "Content-type:text/html;charset=UTF-8" . "\r\n";
 // Sender's Email
 // Message lines should not exceed 70 characters (PHP rule), so wrap it
 $message = wordwrap($message, 70, "\r\n");
 // Send Mail By PHP Mail Function
 if (mail($to, $subject, $message, $headers)) {
 echo "Your mail has been sent successfully!";
 } else {
 echo "Failed to send email, try again.";
 exit ;
 }
 }
}
}
?>

The only function of this is to send me an email and it works as I want it, but I am not aware if this form is secure?

Is it possible that someone can exploit this code and upload a shell, or do any other sort of attack against my site.

Answer 1

Since $_POST['vname'] is not escaped, your mail script is vulnerable to a header-splitting attack like this. A cleverly crafted name could be used to make your script CC any arbitrary recipient and thus send spam.