A form lets an anonymous visitor submit data that your server acts on, usually by sending mail and storing the result. That is a legitimate function and an exposure, and the protections that matter are validating on the server, never trusting what was submitted, and limiting what a form can be made to do.

What a form actually does

It accepts input from anyone, hands it to code on your server, and that code does something: sends an email, writes to a database, or both.

Every one of those steps is an opportunity if the input is not treated carefully. The concern is not somebody typing something rude into the message box. It is somebody submitting input crafted to make the server do something it was not asked to.

The abuses that matter

Using your form to send mail elsewhere

Where a form builds an email from submitted fields without sanitising them, it can be manipulated into sending mail to addresses of the attacker's choosing.

The consequence is that your server sends spam, your domain gets listed, and your genuine quotes and invoices stop arriving in inboxes for weeks. This is the most damaging outcome and the least visible until the damage is done.

Injection into whatever stores the data

Where submitted input is passed into a database query without being handled properly, it can alter the query. Modern platforms and frameworks largely prevent this by default, which is one argument for not hand-rolling form handling.

Scripts stored and later executed

Where a submission is displayed back somewhere, in an admin screen or on the page, unsanitised input can include code that runs when it is viewed. The person affected is usually you, looking at your own enquiries.

File uploads

The highest-risk feature a small business form can have. An upload field that accepts anything and stores it in a web-accessible folder can be used to place a file that is then executed.

If you do not genuinely need uploads, do not have them. If you do, restrict the types, rename the files, store them outside the web root, and check the actual content rather than trusting the extension.

Resource abuse

Automated submissions at volume, which consume server resources and can slow or stop the site. Rate limiting handles it.

The protections that actually matter

Where the enquiries go

A security question people do not think of as one.

Form submissions frequently contain names, addresses, phone numbers, and sometimes details of someone's property. That data goes somewhere: an inbox, a database, occasionally a third-party service.

Worth knowing which, and worth checking that the destination is protected. An admin area listing every enquiry you have ever received, behind a weak password, is a more attractive target than the form itself.

It is also worth deciding how long submissions are retained, since keeping every enquiry indefinitely is a growing store of personal information with no reason attached, which your privacy policy should reflect.

Transport

The form must be served over a secure connection, which is now the default rather than an option.

The specific failure to check for is a form on a secure page submitting to an insecure address, which some browsers block and others warn about. It happens after a site is moved to HTTPS and the form action is left pointing at the old address.

Worth testing by submitting a form and confirming the browser shows no warning at the point of submission rather than only on the page.

The practical setup for a small business

Use a maintained form handler rather than custom code. Whether that is a well-supported plugin or a hosted form service, the point is that somebody else is responsible for the class of problems described above and is patching them.

A hosted service has an additional advantage: submissions never touch your server at all, which removes the mail relay and injection exposure entirely. The trade is that the data sits with a third party, which is a decision to make consciously rather than by default.

The test

Submit your own form with unusual input: a very long message, characters like angle brackets and quotation marks, and a newline in the name field.

Nothing should break, nothing strange should appear in the email you receive, and the submission should still arrive. If any of those fail, the handling is not sanitising properly, which is worth fixing before it is found by somebody looking.

And confirm the email still arrives at all, which is the check that catches the more common problem of a form that silently stopped working, as covered in the day after a site is compromised.

Frequently asked questions

What can go wrong with a contact form?

It can be manipulated into sending mail to other addresses, used to inject into a database, made to store scripts that run when you view enquiries, or abused through file uploads and volume.

What is the most damaging form abuse?

Being used to relay mail. Your server sends spam, your domain gets listed, and your genuine quotes and invoices stop reaching inboxes for weeks afterwards.

Is browser-side validation enough?

No. It is for the visitor's convenience and can be bypassed entirely by anyone submitting directly to your server. Validation has to happen server-side as well.

Should my form accept file uploads?

Only if you genuinely need them. If you do, restrict the types, rename the files, store them outside the web root, and check the actual content rather than trusting the extension.

Where do my form submissions actually go?

Worth knowing. They frequently contain names, addresses, and property details, and the admin area listing every enquiry you have received is a more attractive target than the form itself.

What is the simplest way to be safe?

Use a maintained form handler rather than custom code. A hosted service goes further, since submissions never touch your server, though the data then sits with a third party.

West Coast Media Solutions Inc. provides web design, web development, hosting, digital marketing, and business consulting to organisations across Canada, drawing on more than twenty-five years in the field.

Form built years ago by someone you can no longer reach?

We check what it can be made to do, confirm where the enquiries are stored, and move it onto something maintained.

Start a Conversation