Initial project structure

send.php

@@ -0,0 +1,54 @@
+<?php
+session_start();
+
+// Honeypot: if a bot filled in a hidden field, silently discard
+if (!empty($_POST['website'])) {
+    header('Location: index.php?sent=1#contact');
+    exit;
+}
+
+$name    = trim($_POST['name']    ?? '');
+$email   = trim($_POST['email']   ?? '');
+$message = trim($_POST['message'] ?? '');
+$captcha = intval($_POST['captcha'] ?? -9999);
+$expected = intval($_SESSION['captcha_answer'] ?? -1);
+
+// Always clear session captcha after use
+unset($_SESSION['captcha_answer']);
+
+// Validate
+$valid = true;
+if (empty($name) || strlen($name) > 200)                  $valid = false;
+if (empty($email) || !filter_var($email, FILTER_VALIDATE_EMAIL)) $valid = false;
+if (empty($message) || strlen($message) > 5000)            $valid = false;
+if ($captcha !== $expected || $expected === -1)             $valid = false;
+
+if (!$valid) {
+    header('Location: index.php?error=1#contact');
+    exit;
+}
+
+// Sanitize for email body
+$safeName    = strip_tags($name);
+$safeEmail   = strip_tags($email);
+$safeMessage = strip_tags($message);
+
+$to      = 'wizard@fraxle.net';
+$subject = "Fraxle.net enquiry from $safeName";
+$body    = "You have a new enquiry from your website.\n\n"
+         . "Name:    $safeName\n"
+         . "Email:   $safeEmail\n"
+         . "Message:\n$safeMessage\n\n"
+         . "---\nSent via fraxle.net contact form";
+
+$headers  = "From: noreply@fraxle.net\r\n";
+$headers .= "Reply-To: $safeEmail\r\n";
+$headers .= "X-Mailer: PHP/" . phpversion() . "\r\n";
+$headers .= "Content-Type: text/plain; charset=UTF-8\r\n";
+
+if (mail($to, $subject, $body, $headers)) {
+    header('Location: index.php?sent=1#contact');
+} else {
+    header('Location: index.php?error=1#contact');
+}
+exit;