PHP for emailed forms

[rkahn144]

I am using the following script to try to have forms emailed to me. I get an email, but it is blank. Why>?????????

THIS IS MY SCRIPT:

<?
$cust_first_name = $_REQUEST['cust_first_name'] ;
$cust_last_name = $_REQUEST['cust_last_name'] ;
$cust_email = $_REQUEST['cust_email'] ;
$cust_address = $_REQUEST['cust_address'] ;
$cust_city = $_REQUEST['cust_city'] ;
$cust_state = $_REQUEST['cust_state'] ;
$cust_zip = $_REQUEST['cust_zip'] ;
$cust_phone = $_REQUEST['cust_phone'] ;
$number_of_employees = $_REQUEST['number_of_employees'] ;
$cust_company_category = $_REQUEST['cust_company_category'] ;
mail( "info@*******.com", "Contact Us Form Results", "From: $cust_email" );
?>

<?php
exit;?>

[leelee]

from the php manual:

mail ( string to, string subject, string message [, string additional_headers [, string additional_parameters]] )

Just a starter for 10: why have you set up all your $cust_* parameters then not used them?

[rkahn144]

from the php manual:

mail ( string to, string subject, string message [, string additional_headers [, string additional_parameters]] )

Just a starter for 10: why have you set up all your $cust_* parameters then not used them?

--
I havent used them just cause I'm testing it out and want to see if I get any emails with anything. The script you sent me, where do I place that and what exactly would go in the string to area, the addt'l headers area & addt'l parameters area. Thanks for the response.

[leelee]

The "script" I sent is simply the function's signature as gleaned from the php manual: http://uk2.php.net/manual/en/function.mail.php

What results are you getting when you use this? Is it a totally blank email?

[rkahn144]

I am getting this error:

Parse error: parse error, unexpected '@' in /home/virtual/site127/fst/var/www/html/mail2.php on line 12

Here's the script:

<?
$cust_first_name = $_REQUEST['cust_first_name'] ;
$cust_last_name = $_REQUEST['cust_last_name'] ;
$cust_email = $_REQUEST['cust_email'] ;
$cust_address = $_REQUEST['cust_address'] ;
$cust_city = $_REQUEST['cust_city'] ;
$cust_state = $_REQUEST['cust_state'] ;
$cust_zip = $_REQUEST['cust_zip'] ;
$cust_phone = $_REQUEST['cust_phone'] ;
$number_of_employees = $_REQUEST['number_of_employees'] ;
$cust_company_category = $_REQUEST['cust_company_category'] ;
mail ( [email]info@*****.com[/email], Contact Me Please, string message [,cust_first_name, cust_last_name]] )
?>

<?php
exit;?>

[leelee]

change your mail line to:

mail("info@***.com","Contact Me Please","This is a sample message");

forget the rest of the cust_first_name, cust_last_name, etc..

Try that and see what results you get. You should recieve an email with "This is a sample message" as the message text.

[rkahn144]

You're right - I got that message in the email

[leelee]

good, so everything seems to be set up ok. Now, change the "mail" line to something like:

mail("info@***.com","Contact Me Please","first name: $cust_first_name, last name: $cust_last_name, email: $cust_email");

Try again, and see what you get.

[rkahn144]

I get an email, but the email has only:

first name: , last name: , email:

Not the actual inputted name, last name, & email

[leelee]

In that case the script that you've shown above isn't receiving the input data properly. What does the code for your contact form look like?

[rkahn144]

Well here is what I have for the first name for example:

[leelee]

I'm stabbing about blindly in the dark here as I can't see the rest of the code.

Change "row[cust_first_name]" to simply "cust_first_name"

and tell me what happens.

[rkahn144]

Well when i do that...now whe i click submit on the site it doesnt go to my THANK YOU page and I dont get an email period. Here's the full script with that one change u told me to make.

Contact Us


Please complete the application below. The information you provide
helps us to best cater to your needs.



Fields with an (*) are required.

1. First Name





*
2. Last Name





*
3. Email address





*
4. Address





*
5. City





*
6. State




Please Select

Alaska
Alabama
Arkansas
Arizona
California
Colorado
Connecticut
District of Columbia
Delaware
Florida
Georgia
Hawaii
Iowa
Idaho
Illinois
Indiana
Kansas
Kentucky
Louisiana
Massachusetts
Maryland
Maine
Michigan
Minnesota
Missouri
Mississippi
Montana
North Carolina
North Dakota
Nebraska
New Hampshire
New Jersey
New Mexico
Nevada
New York
Ohio
Oklahoma
Oregon
Pennsylvania
Rhode Island
South Carolina
South Dakota
Tennessee
Texas
Utah
Virginia
Vermont
Washington
Wisconsin
West Virginia
Wyoming

*
7. Zip Code





*
8. Phone Number





*
9. Number of Employess




Please Select
1 to 5
6 to 10
11 to 15
16 or more

*
10. Please select the one category which best describes your company.




Please Select
Advertising / Public Relations
Children's related Educational / Entertainment
Computers / System / Data Processing
Computers / WWW / Internet
Direct Marketing
Educational Services
Entertainment
Financial Services
Manufacturing / Production
Nonprofit / Associations
Professional (medical, legal, accounting, etc.)
Publishing / Communications
Retail
Services Business
Software
Sports / Fitness / Health
Other

1225 FRANKLIN AVENUE • SUITE 325 • GARDEN CITY • NEW YORK • 11530

[rkahn144]

WAIT - WHAT YOU TOLD ME TO DO MAKES IT WORK....i WAS MISTAKEN BEFORE....NOW DO I SWITCH EVERYTHING ELSE???

[rkahn144]

It works - I appreciate your help. Just 2 questions:

1) How can I have it so that in the email, instead of me getting something that looks like this:

First Name: Joe, Last Name: Hall, etc

Look like this:

First Name: -----
Last Name: ---

2) Also, I set some fileds in the forms as being required, but if you leave them out, the form doesnt reject you. Is there a way to fix that?

[leelee]

Ah. Glad it worked. Glad you worked out what to do for the rest of the fields.

As for the formatting, you need to format the text that you put in the third parameter of the mail function. http://uk.php.net/manual/en/function.mail.php has some examples, and it also explains how to adjust the headers in the emails.

BE AWARE of the fact that you are accepting untested user input - people can easily attack your system as it stands. For a secure system you need to carefully vet all inputs.

[rkahn144]

Thanks - I am not exactly sure what you mean by them being able to attack my system & me needing to "vet" my inputs...Can you expand a little for me?

[leelee]

First rule of thumb: Always check any inputs you get from external sources. This means, in your case, the input that users put into your form. People could be entering absolutely anything, and if they play around enough with their entries, then they could produce some unexpected results in your code.

The way to protect against this is to comprehensively check any data you get by checking that it conforms to any expectations you have for entries. Names shouldn't contain a ";", for example, and no field should be over a particular length.

The example at the link I gave you is mentioned by "jfonseca at matarese dot com" (search for the name, and you'll find the comment) and is just one more form of the very common "injection"; I expect there are many more.

This is just basic security, and the depth you want to go with it depend entirely on the applications that your code will have. If you're on an intranet and you know that no malicious users can access the form, then you might feel comfortable leaving out security altogether. If you're storing peoples' credit card details on an world accessible site, then you'll be needing some pretty intensive security.