Skip to main content
S
sbudlong
Inspiring
July 8, 2009
Answered

PHP Mail with session variables

  • July 8, 2009
  • 1 reply
  • 4525 views

Below is code for an email collect page, which sends two session variables (email and zipcode) to an email_sub.php page (the form data is also inserted into MySQL). After the form is submitted, I do get the email_sub.php? page where this code works normally

<?php echo $_SESSION['email']; ?>

<?php echo $_SESSION['zipcode']; ?>

However, when the email is sent, the "Subject" and the "To" are sent correctly, but not the variables $email and $zipcode.

From:
Zip:

If I hard code in values for From and Zip, they appear in the email. So it looks as though the session variables are not available to the email_sub.php page.

If anyone can point me in the right direction for a fix, I would greatly appreciate any suggestions.

email_collect.php

<?php require_once('Connections/connMan.php'); ?>
<?php
session_start();
function GetSQLValueString($theValue, $theType, $theDefinedValue = "", $theNotDefinedValue = "")
{
  $theValue = (!get_magic_quotes_gpc()) ? addslashes($theValue) : $theValue;

  switch ($theType) {
    case "text":
      $theValue = ($theValue != "") ? "'" . $theValue . "'" : "NULL";
      break;   
    case "long":
    case "int":
      $theValue = ($theValue != "") ? intval($theValue) : "NULL";
      break;
    case "double":
      $theValue = ($theValue != "") ? "'" . doubleval($theValue) . "'" : "NULL";
      break;
    case "date":
      $theValue = ($theValue != "") ? "'" . $theValue . "'" : "NULL";
      break;
    case "defined":
      $theValue = ($theValue != "") ? $theDefinedValue : $theNotDefinedValue;
      break;
  }
  return $theValue;
}

$editFormAction = $_SERVER['PHP_SELF'];
if (isset($_SERVER['QUERY_STRING'])) {
  $editFormAction .= "?" . htmlentities($_SERVER['QUERY_STRING']);
}

if ((isset($_POST["MM_insert"])) && ($_POST["MM_insert"] == "form1")) {
$email = $HTTP_POST_VARS ["email"];
session_register("email");
$zipcode = $HTTP_POST_VARS ["zipcode"];
session_register("zipcode");
  $insertSQL = sprintf("INSERT INTO email_list (email, zipcode) VALUES (%s, %s)",
                       GetSQLValueString($_POST['email'], "text"),
                       GetSQLValueString($_POST['zipcode'], "int"));

  mysql_select_db($database_connMan, $connMan);
  $Result1 = mysql_query($insertSQL, $connMan) or die(mysql_error());

  $insertGoTo = "email_sub.php";
  if (isset($_SERVER['QUERY_STRING'])) {
    $insertGoTo .= (strpos($insertGoTo, '?')) ? "&" : "?";
    $insertGoTo .= $_SERVER['QUERY_STRING'];
  }
  header(sprintf("Location: %s", $insertGoTo));
}

mysql_select_db($database_connMan, $connMan);
$query_rsEmailer = "SELECT * FROM email_list";
$rsEmailer = mysql_query($query_rsEmailer, $connMan) or die(mysql_error());
$row_rsEmailer = mysql_fetch_assoc($rsEmailer);
$totalRows_rsEmailer = mysql_num_rows($rsEmailer);
?>
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
<html>
<head>
<title>Touch 'Em All Baseball Camps</title>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<link href="assets/taylor.css" rel="stylesheet" type="text/css">
<script type="text/JavaScript">
<!--
function MM_findObj(n, d) { //v4.01
  var p,i,x;  if(!d) d=document; if((p=n.indexOf("?"))>0&&parent.frames.length) {
    d=parent.frames[n.substring(p+1)].document; n=n.substring(0,p);}
  if(!(x=d)&&d.all) x=d.all; for (i=0;!x&&i<d.forms.length;i++) x=d.forms;
  for(i=0;!x&&d.layers&&i<d.layers.length;i++) x=MM_findObj(n,d.layers.document);
  if(!x && d.getElementById) x=d.getElementById(n); return x;
}

function MM_validateForm() { //v4.0
  var i,p,q,nm,test,num,min,max,errors='',args=MM_validateForm.arguments;
  for (i=0; i<(args.length-2); i+=3) { test=args[i+2]; val=MM_findObj(args);
    if (val) { nm=val.name; if ((val=val.value)!="") {
      if (test.indexOf('isEmail')!=-1) { p=val.indexOf('@');
        if (p<1 || p==(val.length-1)) errors+='- '+nm+' must contain an e-mail address.\n';
      } else if (test!='R') { num = parseFloat(val);
        if (isNaN(val)) errors+='- '+nm+' must contain a number.\n';
        if (test.indexOf('inRange') != -1) { p=test.indexOf(':');
          min=test.substring(8,p); max=test.substring(p+1);
          if (num<min || max<num) errors+='- '+nm+' must contain a number between '+min+' and '+max+'.\n';
    } } } else if (test.charAt(0) == 'R') errors += '- '+nm+' is required.\n'; }
  } if (errors) alert('The following error(s) occurred:\n'+errors);
  document.MM_returnValue = (errors == '');
}
//-->
</script>
</head>

<body>
<form method="post" name="form1" action="<?php echo $editFormAction; ?>">
  <table width="325" align="center">
    <tr valign="baseline">
      <td colspan="2" align="left">
        <h1 class="subhead">Join Our Email List</h1>
        <p>Please fill in the boxes and click &quot;Send.&quot; This information is kept private and is intended for the exclusive use of <strong>Hank Manning's Touch 'Em All Baseball Camps</strong> in order to email you the latest events on our schedule.
        </p>
   
<p> </p>
</td>
    </tr>
    <tr valign="baseline">
      <td align="right" valign="middle" nowrap><p>Email:</p></td>
      <td align="left" valign="middle"><input name="email" type="text" onBlur="MM_validateForm('email','','RisEmail');return document.MM_returnValue" size="32" value="Email address"></td>
    </tr>
    <tr valign="baseline">
      <td align="right" valign="middle" nowrap><p>Zipcode:</p></td>
      <td align="left" valign="middle"><input name="zipcode" type="text" onBlur="MM_validateForm('zipcode','','RisNum');return document.MM_returnValue" size="32" value="Zip code"></td>
    </tr>
    <tr valign="baseline">
      <td align="right"><input type="reset" name="Reset2" value="Reset"><br>
      <input type="submit" value="Send "></td>
      <td> </td>
    </tr>
  </table>
  <input type="hidden" name="MM_insert" value="form1">
</form>
<p> </p>
</body>
</html>
<?php
// mysql_free_result() will free all memory associated with the result identifier result .

//mysql_free_result() only needs to be called if you are concerned about how much memory is being used for queries that return large result sets. All associated result memory is automatically freed at the end of the script's execution.
mysql_free_result($rsEmailer);
?>

email_sub.php

<?php session_start(); // This connects to the existing session

//email sent out

//sbudlong@example.com, hmanning@example.com
mail('sbudlong@example.com, hmanning@example.com', 'Join Email List', "From: $email\r\n Zip: $zipcode");
?>
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
<html>
<head>
<title>Touch 'Em All Baseball Camps</title>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<link href="assets/taylor.css" rel="stylesheet" type="text/css">
</head>

<body>


<table width="280" border="0" cellspacing="0" cellpadding="0">
  <tr>
    <td colspan="2"><img src="images/manning_logo.jpg" width="426" height="64"></td>
  </tr>
  <tr valign="top">
    <td colspan="2"><p> </p>
    <p align="left">Thank you for submitting your email and zipcode.</p>
    <table width="350" border="0" cellspacing="0" cellpadding="0">
      <tr>
        <td width="69"><p align="right">email: </p></td>
        <td width="281"><p align="left"><?php echo $_SESSION['email']; ?></p></td>
      </tr>
      <tr>
        <td><p align="right">zipcode: </p></td>
        <td><p align="left"><?php echo $_SESSION['zipcode']; ?></p></td>
      </tr>
    </table>    <p align="left">This information will be stored in our database for the exclusive use of <strong>Hank Manning's Touch 'Em All Baseball Camps</strong>, which respects and protects your privacy.</p>   
    </td>
  </tr>
  <tr>
    <td width="407" align="left"><a href="javascript:window.close();">close window</a></td>
    <td width="19"><p> </p></td>
  </tr>
</table>
<p> </p>
<p> </p>
<?php
//end session so that I can see new variables as they are passed in development
session_destroy(); ?>
</body>
</html>

This topic has been closed for replies.
Correct answer David_Powers

sbudlong wrote:

I made the change you suggested but the email still showsFrom:Zip:with no values for the variables. Is there a problem with the session?

It looks as though you're not using the session variables when you send the mail:

mail('sbudlong@example.com, hmanning@example.com', 
'Join Email List', 
"From: $email\r\n Zip: $zipcode");

Change it to this:

mail('sbudlong@example.com, hmanning@example.com', 
'Join Email List', 
'From: ' . $_SESSION['email'] . "\r\n Zip: " . 
$_SESSION['zipcode']);

1 reply

David_Powers
David_Powers
Inspiring
July 9, 2009

You are using ancient, deprecated code.

$email = $HTTP_POST_VARS ["email"];
session_register("email");
$zipcode = $HTTP_POST_VARS ["zipcode"];
session_register("zipcode");

Change it to this:

$_SESSION['email'] = $_POST['email'];
$_SESSION['zipcode'] = $_POST['zipcode'];

By the way, it is extremely insecure to allow user input from a form to be used as the From header of an email without first checking that it contains only a single email. It lays you open to an exploit called email header injection.

Checking the value of $_POST['email'] can be done with PHP 5 filters. If you're still using PHP 4, you need to use a regular expression to check the email.

S
sbudlongAuthor
Inspiring
July 9, 2009

Thank you, David. Is there a way I can mark the post as answered so that you get points?

David_Powers
David_Powers
Inspiring
July 10, 2009

sbudlong wrote:

Thank you, David. Is there a way I can mark the post as answered so that you get points?

There should be a button marked "Correct Answer". Just click that.

Terms & ConditionsAccessibility statement
Using the community Terms of use Privacy Cookie preferences Do not sell or share my personal information ad choicesAdChoices