Formulaire de Contact Sécurisé

function sanitizeInput(input: string): string {
  return input
    .replace(/<[^>]*>?/gm, "")                // supprimer les balises HTML
    .replace(/javascript:/gi, "")             // éliminer javascript:
    .replace(/on\w+\s*=/gi, "")             // supprimer onclick, onerror...
    .replace(/["']/g, "")                     // retirer les guillemets
    .replace(/[\r\n]/g, " ")                // éviter les injections d'en-tête
    .replace(/[<>]/g, "")                     // supprimer < et >
    .trim()
}

function validateEmail(email: string): boolean { ... }
function validateName(name: string): boolean { ... }
function validateSubject(subject: string): boolean { ... }
function validateMessage(message: string): boolean { ... }

const allowedServices = ["Secure Development Service", "Pentest Service"]
const cleanService = sanitizedSubject.replace("Request: ", "")
 
if (!allowedServices.includes(cleanService)) {
  return NextResponse.json({ error: "Invalid subject content" }, { status: 400 })
}

const bannedPatterns = [/bcc:/i, /cc:/i, /content-type:/i, /to:/i, /from:/i, /reply-to:/i]
 
for (const pattern of bannedPatterns) {
  if (pattern.test(sanitizedMessage) || pattern.test(sanitizedSubject)) {
    return NextResponse.json({ error: "Oops...Error !!" }, { status: 400 })
  }
}

function escapeHTML(str: string): string {
  return str
    .replace(/&/g, "&")
    .replace(/</g, "&lt;")
    .replace(/>/g, "&gt;")
    .replace(/"/g, "&quot;")
    .replace(/'/g, "&#039;")
}

function checkRateLimit(ip: string): boolean {
  // max 5 requêtes / 15 minutes
}

<input type="text" name="website" style="display:none" />

if ("website" in body && body.website !== "") {
  return NextResponse.json({ error: "Bot detected" }, { status: 403 })
}