Need help with php to handle a form and send email

[raulozzi]

So I am officially stuck with this. I am starting a website for a friend of mine and his video game firends. The site ideal, once it is launched with it's own domain name, will allow users to apply to be on their team. I made the form and wrote the php script following some tutorials and uploaded it all to a site. The application page shows beautifully but when you input the information and hit submit it will send the email but it doesn't gatther any of the information the user puts into the form. The application website is www.idroidrandp.com/application (please discard the submit button with the green glow around it, that isn't linked yet.) and a screenshot to the php coding is at www.idroidrandp.com/php . The only thing not in this screen shot is the echo "$theResults" section which has nothing in it yet. Any ideas? Did I do something wrong in the scripting? I am also using godaddy with a linux server to host if that makes a difference. I have also tried using firefox and IE and both do the same thing.

[bregent]

Other than '$micField' , the variables you are inserting into your body variable don't match the variables in your form field assignment. I'm not a php programmer so there may be other problems as well.

[David_Powers]

As bregent says, the names of the variables you're assigning at the top of the script don't match the variables that you're adding to the $body.

Another problem is that you're using lowercase for the $_POST array. For example, you have $_post['gt']. PHP is case-sensitive. It should be $_POST['gt'].

Even when you get those problems sorted out, the script is extremely insecure because you're not checking any of the values submitted. In particular, you're assigning the value of the 'gt' input field to the From: header. This will lay the form wide open to attack by spammers. (Google for "email header injection" to understand the problem.)

If you want to put a value from the form into the headers, you must first make sure it's safe. For example, I see that gt is meant to be an Xbox Live gamertag. Assuming it must contain only letters and numbers, you should sanitize it like this before inserting it into the headers:

$gt = filter_input(INPUT_POST, 'gt', FILTER_VALIDATE_REGEXP, array('options' => array('regexp' => '/^[a-zA-Z0-9]+$/')));