Skip to content
View in the app

A better way to browse. Learn more.
Web Designer Forum

A full-screen app on your home screen with push notifications, badges and more.

To install this app on iOS and iPadOS
  1. Tap the Share icon in Safari
  2. Scroll the menu and tap Add to Home Screen.
  3. Tap Add in the top-right corner.
To install this app on Android
  1. Tap the 3-dot menu (⋮) in the top-right corner of the browser.
  2. Tap Add to Home screen or Install app.
  3. Confirm by tapping Install.

Contact form help

Sp00kie13
in Server Side

Featured Replies

I've set up several forms from my website to email students details to me bot on my booking form My link I cant get the email to display the senders name, in the From:section of the email. it just displays "postmaster@r-m-t.org.uk"

 

Here's the php script:

 

<?php

$_subject = "Website Booking Form";

$_title1 = $_POST['title1']; 
$_other = $_POST['other']; 
$_name1 = $_POST['name1']; 
$_name2 = $_POST['name2'];
$_address1 = $_POST['address1'];
$_address2 = $_POST['address2'];
$_city = $_POST['city'];
$_postcode = $_POST['postcode'];
$_dob = $_POST['dob'];
$_email = $_POST['email'];
$_tel = $_POST['tel'];

$_provisional = $_POST['provisional'];
$_licence = $_POST['licence'];
$_theory = $_POST['theory'];
$_practical = $_POST['practical'];
$_test1 = $_POST['test1'];
$_test3 = $_POST['test3'];
$_test2 = $_POST['test2'];

$_monday = $_POST['monday'];
$_tuesday = $_POST['tuesday'];
$_wednesday = $_POST['wednesday'];
$_thursday = $_POST['thursday'];
$_friday = $_POST['friday'];
$_saturday = $_POST['saturday'];

$_where = $_POST['where'];
$_message = $_POST['message'];

$from = "From: " . $_POST["name1 name2"];

$_message1 = "Title: " . $_title1 . "\n\n" .  "Other: " . $_other  . "\n\n" ."Name: " . $_name1 . "\n\n" . "Surname: " . $_name2 . "\n\n" . "Address1:  " . $_address1 . "\n\n" .   "Address2: " . $_address2 . "\n\n" .  "City: " . $_city . "\n\n" .  "Postcode: " . $_postcode . "\n\n" .  "Date Of Birth: " . $_dob . "\n\n" . "email: " . $_email . "\n\n" . "Contact number: " . $_tel . "\n\n\n\n\n\n" . 

"Provisional Licence: " . $_provisional . "\n\n" . "Licence Number: " . $_licence . "\n\n" . "Theory Test Booked: " . $_theory . "\n\n" .  "Practical Test Booked: " . $_practical . "\n\n" . "Test Date: " . $_test1 . "\n\n" . "Test Time: " . $_test2 . "\n\n" . "Test Centre: " . $_test3 . "\n\n\n\n\n\n" . 

"Monday: " . $_monday . "\n\n" .  "Tuesday: " . $_tuesday . "\n\n" . "Wednesday: " . $_wednesday . "\n\n" .  "Thursday: " . $_thursday . "\n\n" . "Friday: " . $_friday . "\n\n" . "Saturday: " . $_saturday . "\n\n\n\n\n\n" . 

"Additional information: " . $_message . "\n\n\n\n" . "Where did you hear about us: " . $_where . "\n\n\n\n" .




ini_set("sendmail_from", "contact@r-m-t.org.uk ");

mail ( "contact@r-m-t.org.uk", $_subject, $_message1, $_from );

header("Location: ../booking-done.php?name=" . $_name1 . "");

?>

 

Any help would be greatly appreciated

 

Rob

Hello Sp00kie,

 

I saw you use this variable in the "from" part of your mail function: $_from.

This variable is not set, its undefined.

For every variable you make a new one with a bit of text included, but you forget the $_from.

I think thats the reason it falls back to "postmaster@r-m-t.org.uk".

 

Also, you don't use addslashes() or other functions to escape the variables properly.

For security reason I recommend you to fix that. ( google "MySQL injection" )

    •

    Also, you don't use addslashes() or other functions to escape the variables properly.

    For security reason I recommend you to fix that. ( google "MySQL injection" )

    But he/she is not entering anything to a MySQL database...

    Instead of Google-ing something somewhat irrelevant, try 'email injection' or 'http header injection'.

    Edited by andyl

    • Author

    Thanks Guys it works, Is there any way of putting both names in the from section though, this is where my knowledge is very very scetchy.

     

    Thanks

     

    But he/she is not entering anything to a MySQL database...

    Instead of Google-ing something somewhat irrelevant, try 'email injection' or 'http header injection'.

     

     

    Yeah you're right !

    Sorry for my mistake ;)

     

    Thanks Guys it works, Is there any way of putting both names in the from section though, this is where my knowledge is very very scetchy.

     

    Try this:

     

    $from = "From: " . $_POST["name1"] ." and " . $_POST["name2"];

     

    Will output: "From: firstname and secondname"

    In the 'from' section of your email.

    • Author

    Many thanks, Work perfectly!

     

    1 last question. How important is it it to put injection protection into the script, and as this is something I've never used before does anyone know where I could find a decent tutorial or a good example that I could just put somewhere in the script.

    Just google "Mysql injection tutorial".

     

    First article it cam up with was: http://www.tizag.com/mysqlTutorial/mysql-php-sql-injection.php

     

    Short explanation:

    Web-users could input some evil code in the input elements in your form.

    Like: 5; echo "this could be evil code"

    The input will replace the $_POST[] variable, so the final code would be:

     

    $somevariable=5;echo "this could be evil code";

     

    By addind the function addslashes() to any user input you use in your document, the user cannot insert evil code anymore, cause the function adds slashes to the quotes.

    And prevent the evil code to be executed.

     

    $somevariable=5;echo \"this could be evil code\";

    • Author

    I think I might have found a code and the script still appears to be valid, but would it make the script secure?

     

     

    <?php
 if(isset($_POST['Submit'])) {

    //existing code

  }else{

    die("Direct access not allowed!");

  }


$_subject = "Website Booking Form";

$_title1 = $_POST['title1']; 
$_other = $_POST['other']; 
$_name1 = $_POST['name1']; 
$_name2 = $_POST['name2'];
$_address1 = $_POST['address1'];
$_address2 = $_POST['address2'];
$_city = $_POST['city'];
$_postcode = $_POST['postcode'];
$_dob = $_POST['dob'];
$_email = $_POST['email'];
$_tel = $_POST['tel'];

$_provisional = $_POST['provisional'];
$_licence = $_POST['licence'];
$_theory = $_POST['theory'];
$_practical = $_POST['practical'];
$_test1 = $_POST['test1'];
$_test3 = $_POST['test3'];
$_test2 = $_POST['test2'];

$_monday = $_POST['monday'];
$_tuesday = $_POST['tuesday'];
$_wednesday = $_POST['wednesday'];
$_thursday = $_POST['thursday'];
$_friday = $_POST['friday'];
$_saturday = $_POST['saturday'];

$_where = $_POST['where'];
$_message = $_POST['message'];

$from = "From: " . $_POST["name1"];

$_message1 = "Title: " . $_title1 . "\n\n" .  "Other: " . $_other  . "\n\n" ."Name: " . $_name1 . "\n\n" . "Surname: " . $_name2 . "\n\n" . "Address1:  " . $_address1 . "\n\n" .   "Address2: " . $_address2 . "\n\n" .  "City: " . $_city . "\n\n" .  "Postcode: " . $_postcode . "\n\n" .  "Date Of Birth: " . $_dob . "\n\n" . "email: " . $_email . "\n\n" . "Contact number: " . $_tel . "\n\n\n\n\n\n" . 

"Provisional Licence: " . $_provisional . "\n\n" . "Licence Number: " . $_licence . "\n\n" . "Theory Test Booked: " . $_theory . "\n\n" .  "Practical Test Booked: " . $_practical . "\n\n" . "Test Date: " . $_test1 . "\n\n" . "Test Time: " . $_test2 . "\n\n" . "Test Centre: " . $_test3 . "\n\n\n\n\n\n" . 

"Monday: " . $_monday . "\n\n" .  "Tuesday: " . $_tuesday . "\n\n" . "Wednesday: " . $_wednesday . "\n\n" .  "Thursday: " . $_thursday . "\n\n" . "Friday: " . $_friday . "\n\n" . "Saturday: " . $_saturday . "\n\n\n\n\n\n" . 

"Additional information: " . $_message . "\n\n\n\n" . "Where did you hear about us: " . $_where . "\n\n\n\n" .

$_from = "From: " . $_POST["name1"] ." " . $_POST["name2"];


ini_set("sendmail_from", "contact@r-m-t.org.uk ");

mail ( "contact@r-m-t.org.uk", $_subject, $_message1, $_from );

header("Location: ../booking-done.php?name=" . $_name1 . "");


?>

    I think I might have found a code and the script still appears to be valid, but would it make the script secure?

     

     

    <?php
 if(isset($_POST['Submit'])) {

    //existing code

  }else{

    die("Direct access not allowed!");

  }

     

    No this is not the way to make it secure, this way you only check if the input of submit is set and is not empty, wich makes no sense if you want to make your code secure.

     

    It should be like this:

     

     

    <?php
 if(isset($_POST['Submit'])) {

    //existing code

  }else{

    die("Direct access not allowed!");

  }


$_subject = "Website Booking Form";
$_title1 = addslashes($_POST['title1']); 
$_other = addslashes($_POST['other']); 
$_name1 = addslashes($_POST['name1']); 
$_name2 = addslashes($_POST['name2']);
$_address1 = addslashes($_POST['address1']);
$_address2 = addslashes($_POST['address2']);
$_city = addslashes($_POST['city']);
$_postcode = addslashes($_POST['postcode']);
$_dob = addslashes($_POST['dob']);
$_email = addslashes($_POST['email']);
$_tel = addslashes($_POST['tel']);

$_provisional = addslashes($_POST['provisional']);
$_licence = addslashes($_POST['licence']);
$_theory = addslashes($_POST['theory']);
$_practical = addslashes($_POST['practical']);
$_test1 = addslashes($_POST['test1']);
$_test3 = addslashes($_POST['test3']);
$_test2 = addslashes($_POST['test2']);

$_monday = addslashes($_POST['monday']);
$_tuesday = addslashes($_POST['tuesday']);
$_wednesday = addslashes($_POST['wednesday']);
$_thursday = addslashes($_POST['thursday']);
$_friday = addslashes($_POST['friday']);
$_saturday = addslashes($_POST['saturday']);

$_where = addslashes($_POST['where']);
$_message = addslashes($_POST['message']);

$from = "From: " . addslashes($_POST["name1"]);

$_message1 = "Title: " . $_title1 . "\n\n" .  "Other: " . $_other  . "\n\n" ."Name: " . $_name1 . "\n\n" . "Surname: " . $_name2 . "\n\n" . "Address1:  " . $_address1 . "\n\n" .   "Address2: " . $_address2 . "\n\n" .  "City: " . $_city . "\n\n" .  "Postcode: " . $_postcode . "\n\n" .  "Date Of Birth: " . $_dob . "\n\n" . "email: " . $_email . "\n\n" . "Contact number: " . $_tel . "\n\n\n\n\n\n" . 

"Provisional Licence: " . $_provisional . "\n\n" . "Licence Number: " . $_licence . "\n\n" . "Theory Test Booked: " . $_theory . "\n\n" .  "Practical Test Booked: " . $_practical . "\n\n" . "Test Date: " . $_test1 . "\n\n" . "Test Time: " . $_test2 . "\n\n" . "Test Centre: " . $_test3 . "\n\n\n\n\n\n" . 

"Monday: " . $_monday . "\n\n" .  "Tuesday: " . $_tuesday . "\n\n" . "Wednesday: " . $_wednesday . "\n\n" .  "Thursday: " . $_thursday . "\n\n" . "Friday: " . $_friday . "\n\n" . "Saturday: " . $_saturday . "\n\n\n\n\n\n" . 

"Additional information: " . $_message . "\n\n\n\n" . "Where did you hear about us: " . $_where . "\n\n\n\n" .

$_from = "From: " . addslashes($_POST["name1"]) ." " . addslashes($_POST["name2"]);


ini_set("sendmail_from", "contact@r-m-t.org.uk ");

mail ( "contact@r-m-t.org.uk", $_subject, $_message1, $_from );

header("Location: ../booking-done.php?name=" . $_name1 . "");


?>

    Edited by Leonvv

    The post by Leonvv referring to the Tizag link is to prevent injection into a MySQL database, which the OP hasn't got.

     

    This link http://phpsense.com/2006/php-email-injection-attacks/ refers to preventing email injection for multiple spamming by removing the newlines and carriage returns from the incoming data.

    Create an account or sign in to comment
    Go to topic listing

    Account

    Navigation

    Search

    Search

    Configure browser push notifications
    Chrome (Android)
    1. Tap the lock icon next to the address bar.
    2. Tap Permissions → Notifications.
    3. Adjust your preference.
    Chrome (Desktop)
    1. Click the padlock icon in the address bar.
    2. Select Site settings.
    3. Find Notifications and adjust your preference.