title: Contact Form input filtering
body: <p>Checking through my contact form I have found Cross Site Scripting vulnerabilities but haven't enough knowledge on how to fix this.</p>
  
  <p>Affected Parameter: name
  Vector Used: ">alert(document.cookie)
  Pattern found: \">alert(document.cookie)
  Complete Attack: /http://##################/contact.php [name=\">alert(document.cookie) &amp;email= &amp;message=]</p>
  
  <p>Affected Parameter: email
  Vector Used: ">alert(document.cookie)
  Pattern found: \">alert(document.cookie)
  Complete Attack: /http://##################/contact.php [name= &amp;email=\">alert(document.cookie) &amp;message=]</p>
  
  <p>Affected Parameter: message
  Vector Used: ">alert(document.cookie)
  Pattern found: \">alert(document.cookie)
  Complete Attack: /http://##################/contact.php [name= &amp;email= &amp;message=\">alert(document.cookie)]</p>
  
  <p>My current form code looks like this</p>
  
  <pre><code>&lt;?php 
  if (isset($_POST['submit'])) { 
      $error = ""; 
  
      if (!empty($_POST['name'])) { 
          $name = $_POST['name']; 
          if (!preg_match('/^[a-zA-Z0-9]+$/i', $name)){  
              $error .= "The name you entered is not valid. &lt;br/&gt;"; 
          } 
      } else { 
          $error .= "You didn't type in your name. &lt;br /&gt;"; 
      } 
  
      if (!empty($_POST['email'])) { 
          $email = $_POST['email']; 
          if (!preg_match("/^[_a-z0-9]+(\.[_a-z0-9-]+)*@[a-z0-9-]+(\.[a-z0-9-]+)*(\.[a-z]{2,3})$/i", $email)){  
              $error .= "The e-mail address you entered is not valid. &lt;br/&gt;"; 
          } 
      } else { 
          $error .= "You didn't type in an e-mail address. &lt;br /&gt;"; 
      } 
  
      if (!empty($_POST['messagesubject'])) { 
          $messagesubject = $_POST['messagesubject']; 
      } else { 
          $error .= "You didn't type in a subject. &lt;br /&gt;"; 
      } 
  
      if (!empty($_POST['message'])) { 
          $message = $_POST['message']; 
      } else { 
          $error .= "You didn't type in a message. &lt;br /&gt;"; 
      } 
  
      if(($_POST['code']) == $_SESSION['code']) {  
          $code = $_POST['code']; 
      } else {  
          $error .= "The captcha code you entered does not match. Please try again. &lt;br /&gt;";     
      } 
  
      if (empty($error)) { 
          $from = 'From: ' . $name . ' &lt;' . $email . '&gt;'; 
          $to = "aaron@fosternetwork.co.uk"; 
          $subject = strip_tags("CWS - Contact Us - \n" . $messagesubject); 
          $content = strip_tags("Name: " . $name . "\nSubject: " . $messagesubject . "\nMessage: \n" . $message); 
          $success = "&lt;h2&gt;Thank you! &lt;span&gt;Your message has been sent!&lt;/span&gt;&lt;/h2&gt;"; 
          mail($to,$subject,$content,$from); 
          $emailSent = true; 
      } 
  } 
  ?&gt; 
  </code></pre>
  
  <p>Form</p>
  
  <pre><code>&lt;form action="contact.php" method="post"&gt; 
  
      &lt;label&gt;Name:&lt;/label&gt; 
      &lt;input type="text" name="name" value="&lt;?php if ($_POST['name']) { echo $_POST['name']; } ?&gt;" /&gt; 
  
      &lt;label&gt;Email:&lt;/label&gt; 
      &lt;input type="text" name="email" value="&lt;?php if ($_POST['email']) { echo $_POST['email']; } ?&gt;" /&gt; 
  
      &lt;label&gt;Subject:&lt;/label&gt; 
      &lt;input type="text" name="messagesubject" value="&lt;?php if ($_POST['messagesubject']) { echo $_POST['messagesubject']; } ?&gt;" /&gt; 
  
      &lt;label&gt;Message:&lt;/label&gt;&lt;br /&gt; 
      &lt;textarea name="message" rows="20" cols="20"&gt;&lt;?php if ($_POST['message']) { echo $_POST['message']; } ?&gt;&lt;/textarea&gt; 
  
      &lt;label&gt;Please input the following code: &lt;img src="captcha.php"&gt;&lt;/label&gt; 
      &lt;input type="text" name="code"&gt; &lt;br /&gt;  
  
      &lt;button type="submit" class="colorButton" name="submit" value="Send message"&gt;Send Message&lt;/button&gt; 
  
  &lt;/form&gt;
  </code></pre>
  
  <p>Any help is really appreciated.</p>