RSK World - PHP Contact Form | Server-side Validation, Email & MySQL | RSK World

PHP Validation Email MySQL Security

PHP Contact Form provides server-side validation, sanitization, and email sending. Features: name, email, optional phone (with format validation), subject dropdown, priority (Low/Normal/High/Urgent), message with live character counter (10–5000 chars). Spam protection: honeypot, session-based rate limiting (e.g. 3 submissions per 5 min per IP), math CAPTCHA. Optional MySQL storage (contact_submissions table) with reference #ID; auto-reply email to the user. All inputs sanitized (XSS); configurable via config.php. By rskworld.in.

If you find this PHP Contact Form useful, you can support with a small contribution.

Secure Fast Trusted

Pay via UPI QR

Scan or tap an amount to auto-generate

₹

Open UPI app

GPay PhonePe Paytm

Download Contact Form

Form Fields & Validation

Name (min 2 chars), email, optional phone (8–20 chars), subject dropdown, priority (Low/Normal/High/Urgent), message (10–5000 chars) with live character counter.

Server-side validation – name, email, phone, subject, message
Sanitization – htmlspecialchars, trim, filter_var for email
Phone optional with format validation (digits, spaces, +, -, parentheses)
Priority levels configurable in config.php (PRIORITY_LEVELS)
Message min/max length and character counter in script.js
Subject dropdown: General Inquiry, Technical Support, Feature Request, Bug Report, Other
Form repopulates on validation errors via GET params

Project Structure & Files

index.php (form page), process.php (POST handler), config.php (DB, email, security flags), includes/functions.php (validation & helpers), assets/css & js.

index.php – form HTML, success/error alerts, CAPTCHA, repopulation
process.php – honeypot, rate limit, CAPTCHA, validation, DB insert, mail, redirect
config.php – USE_LOCAL_DB, DB_*, ADMIN_EMAIL, ENABLE_HONEYPOT, ENABLE_MATH_CAPTCHA
includes/functions.php – sanitize_*, validate_*, generate_math_captcha, check_rate_limit
database.sql / database-local.sql – contact_submissions, rate_limit_log
database-update.sql – add phone, priority columns for existing DBs

Security & Spam Protection

Honeypot field (hidden), session-based rate limiting, math CAPTCHA ("What is 3 + 5?"). All output escaped; inputs sanitized.

Honeypot – website_url field hidden; if filled, treat as bot and redirect
Rate limit – RATE_LIMIT_MINUTES, MAX_SUBMISSIONS_PER_IP (e.g. 3 per 5 min)
Math CAPTCHA – random sum stored in session, validated on submit
get_client_ip() – supports CF, X-Forwarded-For, X-Real-IP, REMOTE_ADDR
record_submission() – appends timestamp to session for rate window
For production: consider CSRF tokens or reCAPTCHA (README)

Email & Auto-Reply

Submissions sent to ADMIN_EMAIL via PHP mail(). Optional auto-reply confirmation to the user with reference number.

Admin email – config: ADMIN_EMAIL, FROM_EMAIL, FROM_NAME, SITE_NAME, SITE_URL
Plain text body: name, email, phone, subject, priority, message, ref #, IP, time
Reply-To set to submitter email for easy reply
ENABLE_AUTO_REPLY – sends confirmation to user with ref # and support info
Success redirect: index.php?success=1&ref=; error redirect with message and field params

Database Integration

Optional MySQL (PDO). contact_submissions table; last insert ID shown as reference number. Supports local (Laragon) or Byet hosting.

USE_LOCAL_DB – true for local (php_contact_form), false for Byet (b11_41100569_1)
INSERT into contact_submissions: name, email, phone, subject, priority, message, ip_address, user_agent
Reference #ID in success message and in admin/user emails
On PDO failure, DEBUG mode shows error message; otherwise silent
database.sql – Byet; database-local.sql – CREATE DATABASE + tables for local

What You Get

Full PHP contact form source: form page, processor, config, validation helpers, CSS, JS, SQL schemas, README, CHANGELOG, LICENSE.

Complete source – php-contact-form/ folder with index.php, process.php, config.php
includes/functions.php – all validation and sanitization helpers
assets/css/style.css, assets/js/script.js – form styling and character counter
database.sql, database-local.sql, database-update.sql
README.md – features, installation, security notes
MIT License. © 2026 Molla Samser (RSK World).

Contact Form Application

PHP 7.4+, MySQL 5.7+ (optional), web server (Apache/Laragon/XAMPP). Configure config.php and import SQL; open index.php.

php-contact-form/ – main app folder
index.php – contact form UI; process.php – POST handler
config.php – DB credentials, ADMIN_EMAIL, security toggles
Import database.sql or database-local.sql; set USE_LOCAL_DB and DB_*
Set ADMIN_EMAIL, FROM_EMAIL; ensure PHP mail() or SMTP works
Author: Molla Samser | rskworld.in

Validation & Sanitization

functions.php: sanitize_string, sanitize_email, sanitize_phone; validate_name, validate_email, validate_phone, validate_subject, validate_message.

validate_name – trim, length >= 2, pattern letters/spaces/hyphen/dot (Unicode)
validate_email – filter_var FILTER_VALIDATE_EMAIL
validate_phone – optional; 8–20 chars, digits/spaces/+/−/(); at least 6 consecutive digits
validate_subject – non-empty, max 150 chars
validate_message – 10–5000 chars (mb_strlen)
Message stored with htmlspecialchars in process.php

Project Features

Server-side validation, email, optional MySQL, honeypot, rate limiting, math CAPTCHA, phone field, priority, auto-reply, reference number, character counter.