Terence wrote:
> Adrienne Boswell said:-
>
>> You don't understand do you? The mailto action is not recommended
>> simply because it is unreliable. There is nothing you can do server
>> side to check the data coming in - yes you can use javascript, but if
>> the client does not have javascript enabled, or does and sends you
>> malicious data, the mailto can do nothing about it, except send the
>> malicious data.
>>
>
> No, Adrianne, YOU don't get it. I described the operations quite
> completely. And we don't use scripting offsite.
> There IS no server side other than the local e-mail service. There is
> no cgi-bin program sitting somewhere and checking the form data
> offsite, because whatever comes back to the e-mail box gets processed
> locally (almost) immediately. I.E. the content is checked on-site and
> either matches the expected internal consistency, and is accepted or
> doesn't and is not further processed. The form logic handles all the
> important decision requirements; the form field data type handles the
> content format; text is parsed by a language processor for
> interpretation of information content; that's enough for us.
>
> So data from a remote (known) person come into the e-mail box (no
> website processing), while for the use of the same form for local
> data input (paper interviews or similar or CAPI), we currently go out-
> and-back to the same e-mail box. Which is why we are looking for a
> method of storing on the same data-input computer.
>
> "Malicious data" is very unlikely because, should it occur, it's easly
> noted and we know the supplier and can take any action we want.
Okay, not it appears that you do not understand. Let's start with some
simple definitions, and forget "offsite" and "onsite".
client: the person or computer visiting your site
server: the computer with the webserver, mailserver handling your site
server-side scripting: runs computer with the webserver serving the
website, GGI, PHP, etc...
client-side scripting: runs in the browser of the client viewing your
site, i.e, JavaScript
mail-server: program that runs on the server that transports POP email
messages from one client to another
mail-client: the program on the client that communicates with the remote
servers to send and receive email, e.g., Outlook, Outlook Express,
Thunderbird, etc.
Now using a "mailto" in a link or as a action in a form is not
recommended for the reasons that Adrianne lists. Its ability to "work"
is predicated on the client having a mail-client installed on their
computer. If they don't then you get NO message. The mailto: link or
action needs to mail-client to compose the email and your clients have
to click send to send the message to their ISP's mail-server in order
for you to get the email. There is no way that you can from the server,
redirect, validate, filter, or even confirm that your client clicked the
send button on their email client!
With a mailto: the only filtering and v=checking for malicious data
would require client-side scripting, JavaScript, that you cannot rely on
being enabled.
Now the *only* reliable way to do what you wish is with server-side
scripting. The form's action goes to a server-side script (language of
your choice) in your server. That script can
* validate the data
* filter out and malicious data
* compose and arrange and format the email
* send email to your server's mail-server
* send messages to other email addresses, like notices to you
* log info to file on server or database
* send "courtesy" reply email to the client
* much, much more...
--
Take care,
Jonathan
-------------------
LITTLE WORKS STUDIO
http://www.LittleWorksStudio.com