Problem with PHP email script

jopasnyt wrote: Thank you very much for your advice. I noticed that you are dealing with PHP as well. Can you find something wrong with this at a quick glance?

Please do not switch topics in the same thread. I have branched the thread, and moved this post to the Dreamweaver Application Development forum. However, on examining your code, I see it's actually related to Flash, because you're using ActionScript 1.0 in the form. I know enough about ActionScript to understand the problem, but any future questions related to working with Flash forms should be posted in the Flash or ActionScript forum.

Can I see anything wrong with your script? Yes, I can see a lot wrong with it, I'm afraid.

First of all,  $HTTP_POST_VARS is deprecated, and won't work on many modern servers. You should use $_POST instead.

Secondly, you use stripslashes() only with one field. If magic_quotes are enabled on your server, all fields should have the slashes stripped out. To get rid of the slashes from the entire $_POST array, you can use this:

// Put this at the start of the PHP script

function stripslashes_deep($value)
{
    $value = is_array($value) ?
                array_map('stripslashes_deep', $value) :
                stripslashes($value);

    return $value;
}
$_POST = stripslashes_deep($_POST);

The next problem is that you are assuming that the PHP script automatically knows the variables submitted from your form. This used to be the case in the days when register_globals was on by default in PHP. However, register_globals has been off by default since 2002. Even if register_globals were on, you have a problem with case sensitivity. As far as PHP is concerned, $phone is different from $Phone.

Long story short: instead of using $phone, etc for your form variables, you need to use $_POST['Phone'], and so on.

You have the following line:

$msg_body .= "Message.textArea:  $message.textarea\n";

You're mixing up your PHP with ActionScript syntax. PHP doesn't use dot notation to access objects and properties. Because it's in double quotes, this would simply add .textarea to the end of the value of $message (which you have already created at the top of the script).

Finally, you're inserting an unvalidated email address into your mail headers. This is extremely insecure, and is likely to turn your form into a spam relay. Unless you can filter the email address to make sure it doesn't contain illegal characters, get rid of the $header_info from your script.

Yes, there are quite a few problems there. It looks to me as though you're relying either on a very old book or have stumbled across a very old PHP tutorial on the web. Apart from the case sensitivity issue, what you have would have worked about seven years ago. It's time to find more up to date and reliable resources.