PHP Mail with session variables

Report · Jul 08, 2009

Below is code for an email collect page, which sends two session variables (email and zipcode) to an email_sub.php page (the form data is also inserted into MySQL). After the form is submitted, I do get the email_sub.php? page where this code works normally

<?php echo $_SESSION['email']; ?>

<?php echo $_SESSION['zipcode']; ?>

However, when the email is sent, the "Subject" and the "To" are sent correctly, but not the variables $email and $zipcode.

From:
Zip:

If I hard code in values for From and Zip, they appear in the email. So it looks as though the session variables are not available to the email_sub.php page.

If anyone can point me in the right direction for a fix, I would greatly appreciate any suggestions.

email_collect.php

<?php require_once('Connections/connMan.php'); ?>
<?php
session_start();
function GetSQLValueString($theValue, $theType, $theDefinedValue = "", $theNotDefinedValue = "")
{
$theValue = (!get_magic_quotes_gpc()) ? addslashes($theValue) : $theValue;

switch ($theType) {
    case "text":
      $theValue = ($theValue != "") ? "'" . $theValue . "'" : "NULL";
      break;
    case "long":
    case "int":
      $theValue = ($theValue != "") ? intval($theValue) : "NULL";
      break;
    case "double":
      $theValue = ($theValue != "") ? "'" . doubleval($theValue) . "'" : "NULL";
      break;
    case "date":
      $theValue = ($theValue != "") ? "'" . $theValue . "'" : "NULL";
      break;
    case "defined":
      $theValue = ($theValue != "") ? $theDefinedValue : $theNotDefinedValue;
      break;
}
return $theValue;
}

$editFormAction = $_SERVER['PHP_SELF'];
if (isset($_SERVER['QUERY_STRING'])) {
$editFormAction .= "?" . htmlentities($_SERVER['QUERY_STRING']);
}

if ((isset($_POST["MM_insert"])) && ($_POST["MM_insert"] == "form1")) {
$email = $HTTP_POST_VARS ["email"];
session_register("email");
$zipcode = $HTTP_POST_VARS ["zipcode"];
session_register("zipcode");
$insertSQL = sprintf("INSERT INTO email_list (email, zipcode) VALUES (%s, %s)",
GetSQLValueString($_POST['email'], "text"),
GetSQLValueString($_POST['zipcode'], "int"));

mysql_select_db($database_connMan, $connMan);
$Result1 = mysql_query($insertSQL, $connMan) or die(mysql_error());

$insertGoTo = "email_sub.php";
if (isset($_SERVER['QUERY_STRING'])) {
$insertGoTo .= (strpos($insertGoTo, '?')) ? "&" : "?";
$insertGoTo .= $_SERVER['QUERY_STRING'];
}
header(sprintf("Location: %s", $insertGoTo));
}

mysql_select_db($database_connMan, $connMan);
$query_rsEmailer = "SELECT * FROM email_list";
$rsEmailer = mysql_query($query_rsEmailer, $connMan) or die(mysql_error());
$row_rsEmailer = mysql_fetch_assoc($rsEmailer);
$totalRows_rsEmailer = mysql_num_rows($rsEmailer);
?>
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
<html>
<head>
<title>Touch 'Em All Baseball Camps</title>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<link href="assets/taylor.css" rel="stylesheet" type="text/css">
<script type="text/JavaScript">
<!--
function MM_findObj(n, d) { //v4.01
var p,i,x; if(!d) d=document; if((p=n.indexOf("?"))>0&&parent.frames.length) {
d=parent.frames[n.substring(p+1)].document; n=n.substring(0,p);}
if(!(x=d)&&d.all) x=d.all; for (i=0;!x&&i<d.forms.length;i++) x=d.forms;
for(i=0;!x&&d.layers&&i<d.layers.length;i++) x=MM_findObj(n,d.layers.document);
if(!x && d.getElementById) x=d.getElementById(n); return x;
}

<body>
<form method="post" name="form1" action="<?php echo $editFormAction; ?>">
<table width="325" align="center">
    <tr valign="baseline">
      <td colspan="2" align="left">
        <h1 class="subhead">Join Our Email List</h1>
        <p>Please fill in the boxes and click "Send." This information is kept private and is intended for the exclusive use of <strong>Hank Manning's Touch 'Em All Baseball Camps</strong> in order to email you the latest events on our schedule.
        </p>

<p> </p>
</td>
    </tr>
    <tr valign="baseline">
      <td align="right" valign="middle" nowrap><p>Email:</p></td>
      <td align="left" valign="middle"><input name="email" type="text" onBlur="MM_validateForm('email','','RisEmail');return document.MM_returnValue" size="32" value="Email address"></td>
    </tr>
    <tr valign="baseline">
      <td align="right" valign="middle" nowrap><p>Zipcode:</p></td>
      <td align="left" valign="middle"><input name="zipcode" type="text" onBlur="MM_validateForm('zipcode','','RisNum');return document.MM_returnValue" size="32" value="Zip code"></td>
    </tr>
    <tr valign="baseline">
      <td align="right"><input type="reset" name="Reset2" value="Reset"><br>
      <input type="submit" value="Send "></td>
      <td> </td>
    </tr>
</table>
<input type="hidden" name="MM_insert" value="form1">
</form>
<p> </p>
</body>
</html>
<?php
// mysql_free_result() will free all memory associated with the result identifier result .

//mysql_free_result() only needs to be called if you are concerned about how much memory is being used for queries that return large result sets. All associated result memory is automatically freed at the end of the script's execution.
mysql_free_result($rsEmailer);
?>

email_sub.php

<?php session_start(); // This connects to the existing session

//email sent out

//sbudlong@example.com, hmanning@example.com
mail('sbudlong@example.com, hmanning@example.com', 'Join Email List', "From: $email\r\n Zip: $zipcode");
?>
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
<html>
<head>
<title>Touch 'Em All Baseball Camps</title>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<link href="assets/taylor.css" rel="stylesheet" type="text/css">
</head>

<body>

<table width="280" border="0" cellspacing="0" cellpadding="0">
<tr>
    <td colspan="2"><img src="images/manning_logo.jpg" width="426" height="64"></td>
</tr>
<tr valign="top">
    <td colspan="2"><p> </p>
    <p align="left">Thank you for submitting your email and zipcode.</p>
    <table width="350" border="0" cellspacing="0" cellpadding="0">
      <tr>
        <td width="69"><p align="right">email: </p></td>
        <td width="281"><p align="left"><?php echo $_SESSION['email']; ?></p></td>
      </tr>
      <tr>
        <td><p align="right">zipcode: </p></td>
        <td><p align="left"><?php echo $_SESSION['zipcode']; ?></p></td>
      </tr>
    </table>    <p align="left">This information will be stored in our database for the exclusive use of <strong>Hank Manning's Touch 'Em All Baseball Camps</strong>, which respects and protects your privacy.</p>
    </td>
</tr>
<tr>
    <td width="407" align="left"><a href="javascript:window.close();">close window</a></td>
    <td width="19"><p> </p></td>
</tr>
</table>
<p> </p>
<p> </p>
<?php
//end session so that I can see new variables as they are passed in development
session_destroy(); ?>
</body>
</html>

Report · Jul 09, 2009

You are using ancient, deprecated code.

$email = $HTTP_POST_VARS ["email"];
session_register("email");
$zipcode = $HTTP_POST_VARS ["zipcode"];
session_register("zipcode");

Change it to this:

$_SESSION['email'] = $_POST['email'];
$_SESSION['zipcode'] = $_POST['zipcode'];

By the way, it is extremely insecure to allow user input from a form to be used as the From header of an email without first checking that it contains only a single email. It lays you open to an exploit called email header injection.

Checking the value of $_POST['email'] can be done with PHP 5 filters. If you're still using PHP 4, you need to use a regular expression to check the email.

Report · Jul 09, 2009

Thank you, David. Is there a way I can mark the post as answered so that you get points?

Report · Jul 10, 2009

sbudlong wrote:
Thank you, David. Is there a way I can mark the post as answered so that you get points?

There should be a button marked "Correct Answer". Just click that.

Report · Jul 09, 2009

I made the change you suggested but the email still showsFrom:Zip:with no values for the variables. Is there a problem with the session?

Report · Jul 10, 2009

sbudlong wrote:
I made the change you suggested but the email still showsFrom:Zip:with no values for the variables. Is there a problem with the session?

It looks as though you're not using the session variables when you send the mail:

mail('sbudlong@example.com, hmanning@example.com', 
'Join Email List', 
"From: $email\r\n Zip: $zipcode");

Change it to this:

mail('sbudlong@example.com, hmanning@example.com', 
'Join Email List', 
'From: ' . $_SESSION['email'] . "\r\n Zip: " . 
$_SESSION['zipcode']);

Report · Jul 10, 2009

Thank you, David. That was the problem. Now how do I mark the post question as answered so that you get ten points?

Report · Jul 10, 2009

sbudlong wrote:
Thank you, David. That was the problem. Now how do I mark the post question as answered so that you get ten points?

If you are viewing the forum through the web interface, the person who started the thread (in other words, you) should see the following buttons at the foot of each answer:

Clicking Helpful Answer gives the respondent 5 points. Clicking Correct Answer gives 10 points. Once you have selected an answer in this way, you cannot change your mind. The only person who can see those buttons is the original poster.

It's nice of you to want to give the points, but it's not strictly necessary. As long as your problem has been solved, that's the main thing.

Report · Aug 30, 2009

Thanks for the solution David! Really helped a lot!

PHP Mail with session variables

1 Correct answer