Help with php file?

Report · Mar 06, 2010

Hi there, I'm having some real trouble making this php file work. I'm very new to website design and would very much appreciate a helping hand.

Please see the attached php coding below.

<?php

/* Email Variables */

$emailSubject = 'contactformprocess!';
$webMaster = [email address removed by moderator];

/* Data Variables */

$email = $_POST['email'];
$name = $_POST['name'];
$comments = $_POST['comments'];

$body = <<<EOD
<br><hr><br>
Name: $name <br>
Email: " . $email . "<br>

Comments: " . $comments . "<br>
EOD;
$headers = "From: " . $email . "\r\n"; $headers .= "Content-type: text/html\r\n";
$success = mail($webMaster, $emailSubject, $body, $headers);

/* Results rendered as HTML */

$theResults = <<<EOD
<html>
<head>
<title>sent message</title>
<meta http-equiv="refresh" content="3;URL=http://www.dryiceproductions.com/contact.html">
<style type="text/css">
<!--
body {
background-color: #444;
font-family: Verdana, Arial, Helvetica, sans-serif;
font-size: 20px;
font-style: normal;
line-height: normal;
font-weight: normal;
color: ##90C1E5;
text-decoration: none;
padding-top: 200px;
margin-left: 150px;
width: 800px;
}

-->
</style>
</head>
</body>
</html>

$theResults = "" . "" . "". "" . "" . "" . "
Your email has been sent!
" . "You will return to Dry Ice Productions Ltd in a few seconds!
" . "" . "" . "" . echo "$theResults";
?>

Open to any ideas you may have,

Many thanks.

Report · Mar 06, 2010

NewbieNZ wrote:
Hi there, I'm having some real trouble making this php file work.

This thread has been moved to the correct forum (Dreamweaver Application Development).

What do you mean by "real trouble"? Explain the problem rather than expecting other people to trawl through your code to spot potential mistakes. Take a few moments to read How to get help quickly.

I have had a quick look at your code. There are two glaringly obvious problems:

You're inserting the user's email in the headers without filtering it. This lays you open to email injection, a serious security risk.
The value assigned to $theResults is causing multiple syntax errors.

To deal with the email injection problem, you should filter the email like this (requires PHP 5.2 or above):

$email = filter_input(INPUT_POST, 'email', FILTER_VALIDATE_EMAIL);

This assigns the email address to $email only if it validates. Otherwise, it returns FALSE. If it returns FALSE, you should not send the email, because someone is trying to hack you.

$theResults section should look like this:

$theResults = <<<EOD
<html>
<head>
<title>sent  message</title>
<meta http-equiv="refresh"  content="3;URL=http://www.dryiceproductions.com/contact.html">
<style  type="text/css">
<!--
body {
background-color: #444;
font-family:  Verdana, Arial, Helvetica, sans-serif;
font-size: 20px;
font-style:  normal;
line-height: normal;
font-weight: normal;
color:  #90C1E5;
text-decoration: none;
padding-top: 200px;
margin-left:  150px;
width: 800px;
}
-->
</style>
</head>
<body>
<p>Your email has been sent!</p>
<p>You will return to Dry Ice Productions Ltd in a few seconds!</p>
</body>
</html>
EOD;
echo $theResults;

[Edited final line of code]

Report · Mar 06, 2010

Thanks David, I'm having real trouble because website development is very new to me and might as well be in an alien language.

I really appreciate your help by looking through the code. "Your message has been sent" now shows up in on my contact page which is fantastic!

The problem I'm having now is that the details that you fill out on the contact form eg Name, Email & Message are not being forwarded to my email address.

The email message I recieve shows only this...

Name:
Email: " . . "
Comments: " . . "

Have I forgotten some code?

Also regarding the email injection code - another great tip! Should I place the code below under email variables or data variables?

$email = filter_input(INPUT_POST, 'email', FILTER_VALIDATE_EMAIL);

Thank you very much for your patience:)

Report · Mar 07, 2010

If you're getting no data, it probably means there's a mistake in your form. When using $_POST, you need to set the form's method to POST. Also, the names of the input fields on the form must match the $_POST variables, which are case-sensitive.

Checking the email address should be the first thing you do. If the address fails the validation test, don't go any further.

$email = filter_input(INPUT_POST, 'email', FILTER_VALIDATE_EMAIL);
if ($email) {
  // process the email
} else {
  echo 'Sorry, there was a problem with your message.';
}