I recently faced a problem where, I am receiving emails from an unknown source. Somehow they bypass the validation for email and sending me SQL statement in email fields for example: (SELECT CHAR(113)+CHAR(113)+CHAR(118)+CHAR(98)+CHAR(113)+(SELECT (CASE WHEN (8513=8513) THEN CHAR(49) ELSE CHAR(48) END))+CHAR(113)+CHAR(107)+CHAR(113)+CHAR(98)+CHAR(113))
That's what I am receiving on my email that, I set on Magento contacts configuration. When I tried to find out the exact issue, I found out that If I save the HTML of contact page and remove all the validation from there, then I can able to submit the form from my local system. I am receiving email even if I submit the form, that I saved on my local system.
I also tried other forms to check for the same, but other forms have validation on the server side too, but only contact form having this issue.
How can we solve this issue?