From 4e7b22fde64b94538114c3bfecf939e00521815b Mon Sep 17 00:00:00 2001
From: muli <muli@mrmuli.de>
Date: Sun, 21 Aug 2022 14:14:32 +0200
Subject: [PATCH] fix: Fix sanitation to not break Umlauts and use specific
 email filter.

---
 assets/php/contact_form.php | 17 ++++++++++-------
 1 file changed, 10 insertions(+), 7 deletions(-)

diff --git a/assets/php/contact_form.php b/assets/php/contact_form.php
index 483eea8..ec0287f 100644
--- a/assets/php/contact_form.php
+++ b/assets/php/contact_form.php
@@ -1,11 +1,14 @@
 <?php
 session_start();
 
-function sanitize_text(string $name) {
-    $text = filter_var($_POST[$name], FILTER_SANITIZE_FULL_SPECIAL_CHARS);
+function sanitize_text(string $name, string $type) {
+    $filters = array(
+        'text' => FILTER_SANITIZE_SPECIAL_CHARS,
+        'email' => FILTER_SANITIZE_EMAIL,
+    );
     $text = trim($text);
+    $text = filter_var($_POST[$name], $filters[$type]);
     $text = stripslashes($text);
-    $text = htmlspecialchars($text);
 
     return $text;
 }
@@ -75,10 +78,10 @@ function prepare_response() {
         $response['errors'][] = 'Wir glauben Sie sind ein Bot.';
     }
     if (!array_key_exists('errors', $response)) {
-        $subject = sanitize_text('subject');
-        $message = sanitize_text('message');
-        $name = sanitize_text('name');
-        $email = sanitize_text('email');
+        $subject = sanitize_text('subject', 'text');
+        $message = sanitize_text('message', 'text');
+        $name = sanitize_text('name', 'text');
+        $email = sanitize_text('email', 'email');
 
         if (!send_message_to_office($subject, $message, $name, $email)) {
             $response['errors'][] = 'Ihre Nachricht konnte nicht übermittelt werden.';