Form Defeats Anti-malware Software

When a few form users are unable to submit your form or get warning messages in their browsers, but others can use the form with no problem, it may have to do with anti-malware software the user has installed on their computer.

A number of months ago, it happened to a website using Master Form V4.

The form was being submitted to another domain, which is likely what triggered the user's anti-malware software. (Master Form V4 can accept form submissions from any domain.)

The solution was simple and I'll disclose it in a moment.

If your form submits to a script on a domain other than where the form is located, anti-malware software may incorrectly alert the user to a security risk.

It most likely would depend on the settings the user has specified, but that's neither here nor there. The user thinks your form isn't working or it has malicious code.

You're innocent, of course. But the user doesn't know that. All they're focused on is your form not working and the message they're seeing.

The solution is to submit the form to a relay script located on the same domain as the form.

The form submits to the relay script and the relay script submits the form data to Master Form V4 at the other domain. It works a treat.

Here's the script. A customization note follows.

<?php
/* 
   Form Submission Relay
   Version 1.0
   December 23, 2013

   Will Bontrager Software LLC
   https://www.willmaster.com/
   Copyright 2013 Will Bontrager Software LLC

   This software is provided "AS IS," without 
   any warranty of any kind, without even any 
   implied warranty such as merchantability 
   or fitness for a particular purpose.
   Will Bontrager Software LLC grants 
   you a royalty free license to use this 
   software provided this notice appears 
   on all copies. 
*/

/* Customization */

$relayURL = 'http://www.example.com/cgi-bin/MasterFormV4.cgi';

/* End customization */


$relayMethod = substr( strtolower($_SERVER['REQUEST_METHOD']), 0, 1 );
if( $relayMethod == 'g' ) { GETaPage(); }
else { POSTaPage(); }
exit;

function POSTaPage()
{
   global $relayURL;
   $data = PrepareData();
   $options = cURLoptions();
   $options[CURLOPT_POST] = 1;
   $options[CURLOPT_POSTFIELDS] = $data;
   $info = array();
   $ch = curl_init($relayURL);
   curl_setopt_array($ch,$options);
   $content = curl_exec($ch);
   $err = curl_errno($ch);
   $errmsg = curl_error($ch) ;
   curl_close($ch);
   if( $err ) { echo "ERROR: $errmsg<hr>"; }
   echo $content;
} # function POSTaPage()


function GETaPage()
{
   global $relayURL;
   $data = PrepareData();
   $options = cURLoptions();
   $url = $relayURL . "?$data";
   $info = array();
   $ch = curl_init($url);
   curl_setopt_array($ch,$options);
   $content = curl_exec($ch);
   $err = curl_errno($ch);
   $errmsg = curl_error($ch) ;
   curl_close($ch);
   if( $err ) { echo "ERROR: $errmsg<hr>"; }
   echo $content;
} # function GETaPage()


function PrepareData()
{
   global $relayMethod;
   if( $relayMethod == 'g' ) { return URLencodeData($_GET); }
   else { return URLencodeData($_POST); }
} # function PrepareData()


function URLencodeData($ar)
{
   if( ! count($ar) ) { return ''; }
   $ta = array();
   foreach($ar as $k => $v)
   {
      if( is_array($ar[$k]) )
      {
         foreach( $ar[$k] as $kk => $vv )
         {
            if( is_array($ar[$k][$kk]) )
            {
               foreach( $ar[$k][$kk] as $kkk => $vvv )
               {
                  $ta[] = urlencode(stripslashes($k)) . '[' . urlencode(stripslashes($kk)) . '][' . urlencode(stripslashes($kkk)) . ']=' . urlencode(stripslashes($vvv));
               }
            }
            else { $ta[] = urlencode(stripslashes($k)) . '[' . urlencode(stripslashes($kk)) . ']=' . urlencode(stripslashes($vv)); }
         }
      }
      else { $ta[] = urlencode(stripslashes($k)) . '=' . urlencode(stripslashes($v)); }
   }
   return implode('&',$ta);
} # function URLencodeData()


function cURLoptions()
{
   $options = array(
      CURLOPT_RETURNTRANSFER => true,  // Return web page
      CURLOPT_HEADER         => false, // Don't return headers
      CURLOPT_CONNECTTIMEOUT => 120,   // Timeout on connect
      CURLOPT_TIMEOUT        => 120,   // Timeout on response
      CURLOPT_FOLLOWLOCATION => true,  // Follow redirects
      CURLOPT_USERAGENT      => $_SERVER['HTTP_USER_AGENT'],
      CURLOPT_VERBOSE        => false
   );
   if( ! empty($_SERVER['HTTP_REFERER']) )
   {
      $options[CURLOPT_REFERER] = $_SERVER['HTTP_REFERER'];
   }
   if( count($_COOKIE) )
   {
      $ta = array();
      foreach( $_COOKIE as $k => $v ) { $ta[] = "$k=$v"; }
      $options[CURLOPT_COOKIE] = implode('; ',$ta);
   }
   return $options;
} # cURLoptions()
?>

Customization note: The only customization is to specify the URL of the script to relay the form data to. The section is marked.

The script requires the PHP cURL library be installed. In my experience, most hosting companies have it preinstalled and ready to go for you.

The relay script works for Master Form V4 and should work for other scripts.

If you have a need for it, give it a try. Users' anti-malware software doesn't have to prevent your form from working.

Will Bontrager