Documentation for safemail.cgi

• Hackers cannot use safemail to send anonymous email.  This is a weekness of any CGI email script that uses a CGI variable for a destination email address.
• "Spam-bots" can't collect our email addresses from web pages that use safemail .
• Hackers can't use safemail.cgi from other sites.
  

• mailto URLs won't work unless someone has set up the browser-to-email configuration. This can be a complex task and may be modified (incorrectly) when software is installed or updated
• mailto URLs won't work for users that prefer to use web-based email services (like Yahoo or Hotmail)
• mailto URLs may not work correctly if multiple people share a computer
• mailto URLs won't work if the user is at a computer in a public place (such as a library)

Quick Start for BCN Center and Business Pages

Here's the HTML for a simple example:

   Send comments to
   <a href="/cgi-bin/safemail.cgi?nickname=environmentCD">
   the environment center developer.
   </a>

The page editor may want to create a page (called thanks.html) that says "thanks for your comments".

  Send comments to
  <a href="/cgi-bin/safemail.cgi?nickname=environmentCD&next_url=thanks.html">
  the environment center developer.
  </a>

The examples above are displayed as hyperlinks (underlined links). Alternatively, they can be specified as an HTML form; this will display a button.

  Send comments to the environment center developer.
  <form method="POST" action="/cgi-bin/safemail.cgi">
  <INPUT TYPE="hidden" NAME="nickname" Value="environmentCD">
  </form>

The nickname parameter is mandatory; it accepts a list of nicknames separated by commas.  Additional  optional parameters are described below.

BCN Nickname List

Quick Start for Hosted Sites

1. Create a template file - two approaches
• hand edit the HTML source - including an HTML form as described below
• use your favorite HTML WYSIWYG editor with a comment form, then hand verify 
2. Verify that the template includes the elements described below
3. Create a list of valid user nicknames and email addresses (described below)
4. Mail the template and nickname list to me.

The Generated Email

• a warning about the possible non-validity of the reply-to address
• the comments from the user
• some information derived from the HTTP environment
  • the web page that called safemail
  • information about the user's browser
  • the user's computer's host name and address
• a list of all CGI variables and values

Reply-to: joe@somewhere.com (Joe User)
From: joe@somewhere.com (Joe User)
To: BCN toolmaster  
Subject: BCN Center Feedback
      
 --- WARNING!!, the Reply-To email address joe@somewhere.com     ---
 --- is set by a site visitor and may not be legitimate.        ---
 --- Check the Reply-To address carefully before replying.      ---
      
Message From User:

This is a the most amazing email CGI form!  The programmer must be brilliant.
      
The following information is derived from HTTP environmental variables
(in parenthesis) that could be spoofed.
Safemail was called from http://bcn.boulder.co.us/bcn/tools/safemail/test.html (HTTP_REFERER)
The user's browser: Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.0.2) Gecko /20021120 Netscape/7.01 (HTTP_USER_AGENT)
The user's network address:    216.98.199.49 (REMOTE_ADDR)
The user's DNS host name:    dsl-res49.idcomm.com (REMOTE_HOST)
      
CGI variables:
(reply_to)  joe@somewhere.com
(reply_to_name)  Joe User
(tmpl_subject)  BCN Center Feedback
(safemail_sendit)  safemail_sendit
(debug)  1
(nickname)  webmaster
(page_called_from)  http://bcn.boulder.co.us/bcn/tools/safemail/test.html
(next_url)  http://bcn.boulder.co.us/bcn/tools/safemail/test.html

Advanced Features

Logging and Error EMail

Smart follow-up pages

Templates

• a hidden variable named "nickname" with a list of comma-separated nicknames inside <bogotag> and </bogotag>
• text variables "reply_to_name" and "reply_to" if you want the user to provide the email address in the comment form (otherwise, safemail pretends the mail is from "safemail@bcn.boulder.co.us.)
• a textarea variable "comments"
• an html comment - <!-- <bogotag>hidden_vars</bogotag> -->
  

For example:

form method="POST" action="/cgi-bin/safemail.cgi">
<INPUT TYPE="hidden" NAME="nickname" Value="<Bogotag>nickname</Bogotag>">
Your Name: 
  <input type="text" name="reply_to_name">
<br>
Your E-Mail address: (optional)
  <input type="text" name="reply_to">
<br>
<textarea name="comments" rows="10" cols="60">Enter comments here.</textarea>
<input type="submit" value="Submit Comments"> <input type="reset" value="Clear Comments">
<!-- <bogotag>hidden_vars</bogotag> -->
</form>

Nickname Database

webmaster, sue@mysite.org
helper, john@mysite.org

Details on Optional Parameters

safemail-util