XHTML Strict mit AjaxContact?

function sendPosEmail () {
 var success = document.getElementById('emailSuccess');
 var posName = document.getElementById('posName');
 var posEmail = document.getElementById('posEmail');
 var posAcfUrl = document.getElementById('posAcfUrl');
 var posText = document.getElementById('posText');
 var posIP = document.getElementById('posIP');
 var page = \"".$referringPage."?contact=true&xml=true\";
 
 showContactTimer(); // quickly begin the load bar
 success.style.display = 'none'; // hide the success bar (incase this is a multi-email
 
 // convert (&, +, =) to string equivs. Needed so URL encoded POST won't choke.
 var str1 = posName.value;
 str1 = str1.replace(/&/g,\"**am**\");
 str1 = str1.replace(/=/g,\"**eq**\");
 str1 = str1.replace(/\+/g,\"**pl**\");
 var str2 = posEmail.value;
 str2 = str2.replace(/&/g,\"**am**\");
 str2 = str2.replace(/=/g,\"**eq**\");
 str2 = str2.replace(/\+/g,\"**pl**\");
 var str3 = posAcfUrl.value;
 str3 = str3.replace(/&/g,\"**am**\");
 str3 = str3.replace(/=/g,\"**eq**\");
 str3 = str3.replace(/\+/g,\"**pl**\");
 var str4 = posText.value;
 str4 = str4.replace(/&/g,\"**am**\");
 str4 = str4.replace(/=/g,\"**eq**\");
 str4 = str4.replace(/\+/g,\"**pl**\");
 var str5 = posIP.value;
 str5 = str5.replace(/&/g,\"**am**\");
 str5 = str5.replace(/=/g,\"**eq**\");
 str5 = str5.replace(/\+/g,\"**pl**\");
 
 var stuff = \"posIP=\"+str5+\"&posName=\"+str1+\"&posEmail=\"+str2+\"&posAcfUrl=\"+str3+\"&posText=\"+str4;
 loadXMLPosDoc(page,stuff)
}
function showContactTimer () {
 var loader = document.getElementById('loadBar');
 loader.style.display = 'block';
 sentTimer = setTimeout(\"hideContactTimer()\",5000);
}function hideContactTimer () {
 var loader = document.getElementById('loadBar');
 var success = document.getElementById('emailSuccess');
 var fieldArea = document.getElementById('contactform');
 var inputs = fieldArea.getElementsByTagName('input');
 var inputsLen = inputs.length;
 var tAreas = fieldArea.getElementsByTagName('textarea');
 var tAreasLen = tAreas.length;
 // Hide the load bar alas! Done Loading
 loader.style.display = \"none\";
 success.style.display = \"block\";
 success.innerHTML = '<strong>'+grabPosXML(\"confirmation\")+'</strong>';
 // Now Hijack the form elements
 for ( i=0;i<inputsLen;i++ ) {
  if ( inputs[i].getAttribute('type') == 'text' ) {
   inputs[i].value = '';
  }
 }
 for ( j=0;j<tAreasLen;j++ ) {
  tAreas[j].value = '';
 }
}

<?php
/*
Plugin Name: ajaxContact
Author URI: http://www.stimuli.ca
*/
/* Grab our stored default options */
$yourName = get_option('acf_name');
$yourEmail = get_option('acf_email');
$yourSubject = get_option('acf_subject');
$acf_success_msg = get_option('acf_success_msg');
$acf_error_msg = get_option('acf_error_msg');
/* options page */
$options_page = get_option('siteurl') . '/wp-admin/admin.php?page=ajaxContact/options.php';
/* path to the plugin */
$acf_path = (get_settings('siteurl')."/wp-content/plugins/ajaxContact/");
/* grabs the form instance's location */
$referringPage = $_SERVER['REQUEST_URI'];
/* Adds our admin options under "Options" */
function acf_add_options_page() {
add_options_page('Ajax Contact Form Options', 'ajaxContact', 'manage_options', 'ajaxContact/options.php');
}
/* This js needs php variables, so we can't link it like the other js's! */
function contactjs() {
global $acf_error_msg;
global $referringPage;
$myscript = "
function validateFields() {
var frmEl = document.getElementById('cForm');
var posName = document.getElementById('posName');
var posEmail = document.getElementById('posEmail');
var posAcfUrl = document.getElementById('posAcfUrl');
var posText = document.getElementById('posText');
var posIP = document.getElementById('posIP');
var whiteSpace = /^[\s]+$/;
if ( posText.value == '' || whiteSpace.test(posText.value) ) {
alert(\"".$acf_error_msg."\");
} 
 
else {
sendPosEmail();
}
}
function sendPosEmail () {
var success = document.getElementById('emailSuccess');
var posName = document.getElementById('posName');
var posEmail = document.getElementById('posEmail');
var posAcfUrl = document.getElementById('posAcfUrl');
var posText = document.getElementById('posText');
var posIP = document.getElementById('posIP');
var page = \"".$referringPage."?contact=true&amp;xml=true\";
 
showContactTimer(); // quickly begin the load bar
success.style.display = 'none'; // hide the success bar (incase this is a multi-email
 
// convert (&amp;, +, =) to string equivs. Needed so URL encoded POST won't choke.
var str1 = posName.value;
str1 = str1.replace(/&amp;/g,\"**am**\");
str1 = str1.replace(/=/g,\"**eq**\");
str1 = str1.replace(/\+/g,\"**pl**\");
var str2 = posEmail.value;
str2 = str2.replace(/&amp;/g,\"**am**\");
str2 = str2.replace(/=/g,\"**eq**\");
str2 = str2.replace(/\+/g,\"**pl**\");
var str3 = posAcfUrl.value;
str3 = str3.replace(/&amp;/g,\"**am**\");
str3 = str3.replace(/=/g,\"**eq**\");
str3 = str3.replace(/\+/g,\"**pl**\");
var str4 = posText.value;
str4 = str4.replace(/&amp;/g,\"**am**\");
str4 = str4.replace(/=/g,\"**eq**\");
str4 = str4.replace(/\+/g,\"**pl**\");
var str5 = posIP.value;
str5 = str5.replace(/&amp;/g,\"**am**\");
str5 = str5.replace(/=/g,\"**eq**\");
str5 = str5.replace(/\+/g,\"**pl**\");
 
var stuff = \"posIP=\"+str5+\"&amp;posName=\"+str1+\"&amp;posEmail=\"+str2+\"&amp;posAcfUrl=\"+str3+\"&amp;posText=\"+str4;
loadXMLPosDoc(page,stuff)
}
function showContactTimer () {
var loader = document.getElementById('loadBar');
loader.style.display = 'block';
sentTimer = setTimeout(\"hideContactTimer()\",5000);
}
function hideContactTimer () {
var loader = document.getElementById('loadBar');
var success = document.getElementById('emailSuccess');
var fieldArea = document.getElementById('contactform');
var inputs = fieldArea.getElementsByTagName('input');
var inputsLen = inputs.length;
var tAreas = fieldArea.getElementsByTagName('textarea');
var tAreasLen = tAreas.length;
// Hide the load bar alas! Done Loading
loader.style.display = \"none\";
success.style.display = \"block\";
success.innerHTML = grabPosXML(\"confirmation\");
// Now Hijack the form elements
for ( i=0;i&lt;inputsLen;i++ ) {
if ( inputs[i].getAttribute('type') == 'text' ) {
inputs[i].value = '';
}
}
for ( j=0;j&lt;tAreasLen;j++ ) {
tAreas[j].value = '';
}
}
function ajaxContact() {
var frmEl = document.getElementById('cForm');
addEvent(frmEl, 'submit', validateFields, false);
frmEl.onsubmit = function() { return false; }
}
addEvent(window, 'load',ajaxContact, false);";
return $myscript;
}
/* Turn the above function into a seperate js file for linking to: */
/*if ( $_GET['contactjs'] == true ) {
header('Content-Type: text/javascript');
echo contactjs();
}*/
/* CSS added to the header */
function acf_css() {
global $acf_path;
$output = ('<link rel="stylesheet" href="'.$acf_path.'acf_style.css" type="text/css" media="screen" />');
echo $output;
}
/* javascripts added to the page */
function acf_javascripts() { 
global $acf_path;
$output = '
<script type="text/javascript" src="'.$acf_path.'js/functionAddEvent.js"></script>
<script type="text/javascript" src="'.$acf_path.'js/xmlHttp.js"></script>
<script type="text/javascript">'.contactjs().'</script>';
echo $output;
}
 
/*Wrapper function which calls the form.*/
function acf_callback( $content ) {
global $acf_path;
global $acf_success_msg;
/* Run the input check. */
if(! preg_match('|<!--ajax contact form-->|', $content)) { // If there's no match...
return $content; // ...Do nothing!
} else {// We have a match. Show the form.
$form = acf_javascripts().'
<div class="contactright">
<p id="loadBar" style="display:none;">
<strong>Ihre Nachricht wird gesendet&amp;#8230;</strong>
<img src="'.$acf_path.'img/loading.gif" alt="senden..." title="E-Mail Senden" />
</p>
<p id="emailSuccess" style="display:none;">
<strong>'.$acf_success_msg.'</strong>
</p>
</div>
<div id="contactform">
<form action="'.$referringPage.'" method="post" id="cForm">
<div class="contactleft"><label for="posName">Ihr Name:</label></div>
<div class="contactright"><input class="text" type="text" size="25" name="posName" id="posName" />&nbsp;(Pflichtfeld)</div>
<div class="contactleft"><label for="posEmail">Ihre E-Mail:</label></div>
<div class="contactright"><input class="text" type="text" size="25" name="posEmail" id="posEmail" />&nbsp;(Pflichtfeld)</div>
<div class="contactleft"><label for="posText">Ihre Nachricht:</label></div>
<div class="contactright"><textarea cols="80" rows="6" name="posText" id="posText"></textarea></div>
<div class="contactright"><label>
<input class="submit" type="submit" name="sendContactEmail" id="sendContactEmail" value=" E-Mail senden " />
</label></div>
<input type="hidden" name="posIP" id="posIP" value="'.acf_get_IP().'" />
<input type="hidden" name="posAcfUrl" id="posAcfUrl" value="'.$referringPage.'"/>
</form>
</div>
<div style="clear:both; height:1px;">&nbsp;</div>
';
return str_replace('<!--ajax contact form-->', $form, $content);
}
}
/* grabs the poster's IP address */
function acf_get_ip() {
if (isset($_SERVER)) {
if (isset($_SERVER["HTTP_X_FORWARDED_FOR"])) {
$ip_addr = $_SERVER["HTTP_X_FORWARDED_FOR"];
} elseif (isset($_SERVER["HTTP_CLIENT_IP"])) {
$ip_addr = $_SERVER["HTTP_CLIENT_IP"];
} else {
$ip_addr = $_SERVER["REMOTE_ADDR"];
}
} else {
if ( getenv( 'HTTP_X_FORWARDED_FOR' ) ) {
$ip_addr = getenv( 'HTTP_X_FORWARDED_FOR' );
} elseif ( getenv( 'HTTP_CLIENT_IP' ) ) {
$ip_addr = getenv( 'HTTP_CLIENT_IP' );
} else {
$ip_addr = getenv( 'REMOTE_ADDR' );
}
}
return $ip_addr;
}
/* Checks for spammer's input, and abusive behavior */
function acf_is_malicious($input) {
$is_malicious = false;
$bad_inputs = array("\r", "\n", "mime-version", "content-type", "cc:", "to:");
foreach($bad_inputs as $bad_input) {
if(strpos(strtolower($input), strtolower($bad_input)) !== false) {
$is_malicious = true; break;
}
}
return $is_malicious;
}
/* gets rid of sketchy characters like "&amp;,+,-" */
function cleanposUrl ($str) {
$nStr = $str;
$nStr = str_replace("**am**","&amp;",$nStr);
$nStr = str_replace("**pl**","+",$nStr);
$nStr = str_replace("**eq**","=",$nStr);
return stripslashes($nStr);
}
// I'm guessing this script exists in case AJAX is not working on the client(?)
if ( isset($_POST['sendContactEmail']) ) {
$subject = $yourSubject.' from '.cleanposUrl($_POST['posIP']);
$message = cleanposUrl($_POST['posText']);
$headers = "From: ".cleanposUrl($_POST['posName'])." <".$_POST['posEmail'].">\r\n";
$headers .= 'To: '.$yourName.' <'.$yourEmail.'>'."\r\n";
$mailit = mail($yourName,$subject,$message,$headers);
if ( @$mailit ) {
header('Location: '.$referringPage.'?success=true');
} else {
header('Location: '.$referringPage.'?error=true');
}
}
/* if javascript is working, send mail and produce xml */
if ( $_GET['contact'] == true && $_GET['xml'] == true && isset($_POST['posText']) ) {
header('Content-Type: text/xml');
echo '<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<resultset>';
if ( acf_is_malicious($_POST['posText']) || acf_is_malicious($_POST['posEmail']) || acf_is_malicious($_POST['posName'])) {
$posStatus = 'NOTOK'; 
$posConfirmation = 'You can not use any of the following in the Name or Email fields: a linebreak, or the phrases \'mime-version\', \'content-type\', \'cc:\' or \'to:\'.';
} else {
$subject = $yourSubject.' from '.$_POST['posIP'];
$msg = cleanposUrl($_POST['posText']);
$fullmsg = $_POST['posName']." wrote:\n";
$fullmsg .= wordwrap($msg, 80, "\n") . "\n\n";
$fullmsg .= "IP: " .acf_get_ip();
$headers = "MIME-Version: 1.0\n";
$headers = "From: ".$_POST['posName']." <".$_POST['posEmail'].">\n";
$headers .= "Content-Type: text/plain; charset=\"" . get_settings('blog_charset') . "\"\n";
$mailit = mail($yourEmail,$subject,$fullmsg,$headers);
if ( @$mailit ) {
$posStatus = 'OK'; 
$posConfirmation = $acf_success_msg;
} else {
$posStatus = 'NOTOK'; 
$posConfirmation = 'Internal Error: Your Email could not be sent.';
} 
}
echo '
<status>'.$posStatus.'</status>
<confirmation>'.$posConfirmation.'</confirmation>
</resultset>';
}
add_filter('wp_head', 'acf_css');
add_filter('the_content', 'acf_callback', 7);
add_action('admin_head', 'acf_add_options_page');
?>