true,'samesite'=>'Lax','secure'=>!empty($_SERVER['HTTPS']) && $_SERVER['HTTPS'] !== 'off']); session_start(); header('Cache-Control: no-store'); header('X-Content-Type-Options: nosniff'); function h($s): string { return htmlspecialchars((string)$s, ENT_QUOTES | ENT_SUBSTITUTE, 'UTF-8'); } if (empty($_SESSION['csrf'])) { $_SESSION['csrf']=bin2hex(random_bytes(32)); $_SESSION['form_started']=time(); } $choices=['The Stargazer','Sunday Porch','Pink Detour','Golden Hour','Blue Hour','More than one / not sure']; $values=array_fill_keys(['name','email','phone','candy','quantity','message'],''); $errors=[]; if ($_SERVER['REQUEST_METHOD'] === 'POST') { foreach ($values as $key => $v) { $values[$key]=is_string($_POST[$key] ?? null) ? trim($_POST[$key]) : ''; } if (!is_string($_POST['csrf'] ?? null) || !hash_equals($_SESSION['csrf'], $_POST['csrf'])) $errors[]='Your form session expired. Please try again.'; if (!empty($_POST['website']) || time() - ($_SESSION['form_started'] ?? time()) < 3) $errors[]='Please wait a moment and try again.'; if (time() - ($_SESSION['last_attempt'] ?? 0) < 30) $errors[]='Please wait 30 seconds before trying again.'; if ($values['name']==='' || strlen($values['name'])>100 || preg_match('/[\r\n]/',$values['name'])) $errors[]='Please enter a valid name (up to 100 characters).'; if (!filter_var($values['email'], FILTER_VALIDATE_EMAIL) || strlen($values['email'])>254 || preg_match('/[\r\n]/',$values['email'])) $errors[]='Please enter a valid email address.'; if (strlen($values['phone'])>40 || ($values['phone']!=='' && !preg_match('/^[0-9+(). -]+$/', $values['phone']))) $errors[]='Please enter a valid phone number.'; if (!in_array($values['candy'],$choices,true)) $errors[]='Please choose a candy selection.'; if (!ctype_digit($values['quantity']) || (int)$values['quantity']<1 || (int)$values['quantity']>10000) $errors[]='Please enter a quantity between 1 and 10,000.'; if ($values['message']==='' || strlen($values['message'])>3000) $errors[]='Please enter a message of up to 3,000 characters.'; if (!$errors) { $_SESSION['last_attempt']=time(); $body="New candy inquiry\n\nName: ".$values['name']."\nEmail: ".$values['email']."\nPhone: ".$values['phone']."\nCandy: ".$values['candy']."\nQuantity: ".$values['quantity']."\n\nMessage:\n".$values['message']; $headers="From: Morrow & Marble \r\nReply-To: ".$values['email']."\r\nContent-Type: text/plain; charset=UTF-8"; $sent=@mail('info@xenqalo.cfd','New candy inquiry',$body,$headers); if ($sent) { $_SESSION['csrf']=bin2hex(random_bytes(32)); $_SESSION['form_started']=time(); $inquiry_sent=true; include __DIR__.'/thank-you.php'; exit; } $errors[]='Email delivery could not be initiated. Please try later or contact us directly at info@xenqalo.cfd or +1 (612) 871-5057.'; } http_response_code(422); } ?>Contact & Order Inquiry | Morrow & Marble

SMALL BATCHES ✳ BIG CURIOSITY ✳ MADE TO BE SHARED

LET'S TALK CANDY ✳

Well, hello there.

Have a question, a gathering in mind, or a candy you can't stop thinking about? Drop us a note.

GET IN TOUCH

We're all ears (and sweet tooth).

Tell us a little about what you're looking for. We'll discuss availability and details directly.

EMAILinfo@xenqalo.cfd

PHONE+1 (612) 871-5057

BUSINESS ADDRESS

10832 Upton Ave S
Bloomington, MN 55431, USA

Please contact us before visiting.

ORDER INQUIRY ✳

Tell us what you're dreaming up.

All fields are required unless marked optional. An inquiry is not an order or payment.

We couldn't send your inquiry.