{"id":2435,"date":"2021-08-05T09:49:05","date_gmt":"2021-08-05T09:49:05","guid":{"rendered":"https:\/\/phptutorial.net\/?page_id=2435"},"modified":"2025-04-08T04:13:41","modified_gmt":"2025-04-08T04:13:41","slug":"php-contact-form","status":"publish","type":"page","link":"https:\/\/www.phptutorial.net\/php-tutorial\/php-contact-form\/","title":{"rendered":"PHP Contact Form"},"content":{"rendered":"\n

Summary<\/strong>: in this tutorial, you’ll learn how to build a contact form in PHP that includes form validation, sending email, honeypot, etc.<\/p>\n\n\n\n

Introduction to the PHP contact form #<\/a><\/h2>\n\n\n\n

A contact form allows visitors of a website to leave messages. Typically, a contact form has the name, email, subject, and message input fields:<\/p>\n\n\n\n

\"PHP<\/a><\/figure>\n\n\n\n

The visitors need to fill out these fields and click the submit (or send) button to send a message. In PHP, you can validate the form data<\/a> and send the message to an email address<\/a>.<\/p>\n\n\n\n

The contact form is a target for spammers who use spambots to send unsolicited messages for advertising, phishing, spreading malware, etc.<\/p>\n\n\n\n

A spambot is software that automates the spam activities like filling out and submitting contact forms automatically.<\/p>\n\n\n\n

To build a spam-free contact form, you can add a captcha to it. Sometimes, captchas are very difficult to read. Hence, they do not create a good experience for legitimate users.<\/p>\n\n\n\n

To avoid using a captcha while protecting the contact form from spam, you can use a honeypot to trick spambots.<\/p>\n\n\n\n

A honeypot is a field on the form that the visitor cannot see, but spambots can. When a spambot sees the honeypot field, it fills the field with a value. In PHP, you can check if the honeypot has a value and skip sending the message.<\/p>\n\n\n\n

To create a honeypot, you need to have a CSS class that completely hide the honeypot field as follows:<\/p>\n\n\n

.user-cannot-see<\/span> {\n    display<\/span>:none\n}<\/code><\/span>Code language:<\/span> CSS<\/span> (<\/span>css<\/span>)<\/span><\/small><\/pre>\n\n\n
And you have a honeypot field on the form:<\/p>\n\n\n
<label<\/span> for<\/span>=\"nickname\"<\/span> aria-hidden<\/span>=\"true\"<\/span> class<\/span>=\"user-cannot-see\"<\/span>><\/span> Nickname\n    <input<\/span> type<\/span>=\"text\"<\/span> \n           name<\/span>=\"nickname\"<\/span> \n           id<\/span>=\"nickname\"<\/span> \n           class<\/span>=\"user-cannot-see\"<\/span> \n           autocomplete<\/span>=\"off\"<\/span> \n           tabindex<\/span>=\"-1\"<\/span>><\/span>\n<\/label<\/span>><\/span><\/code><\/span>Code language:<\/span> HTML, XML<\/span> (<\/span>xml<\/span>)<\/span><\/small><\/pre>\n\n\n
Note that the name of the honeypot should look legitimate. Recently, the spambot has become smarter that can detect the honeypot.<\/p>\n\n\n\n
To deal with these smart spambots, you need a smart honeypot. For example, a smart honeypot may have a different name for each request. Additionally, its location on the form is changed randomly.<\/p>\n\n\n\n
Creating the contact form #<\/a><\/h2>\n\n\n\n
We’ll build a contact form<\/a> as shown in the following picture:<\/p>\n\n\n\n
The contact form has the following features:<\/p>\n\n\n\n