I've created a contact form for my website, and I've written some PHP code to send the results to my email address (I don't know if it works or not yet because I haven't uploaded my website to an internet server). Could someone tell me if the code looks OK, or if there's something that needs changing please?

 

This is my HTML code:

<form name="form1" method="post" action="contact-us-submit.php">
<label for="text1">Name</label><input name="name" type="text" size="35" />
<label for="text2">Email Address</label><input name="email" type="text" size="35" />
<label for="textarea1">Message</label><textarea name="message" cols="28" rows="5"></textarea>
<input name="Reset" type="reset" value="Reset" />
<input name="Submit" type="submit" value="Submit" />
</form>

This is the PHP code on the 'contact-us-submit.php' page:

<?php
  $name=$_POST["name"];
  $email=$_POST["email"];
  $message=$_POST["message"];
  $to="myemail@domain.com";
  mail($name, $email, $message, $to);
  ?>

I've tried to do it myself, but I'm not sure if I've done it right or not (because I've taken tips from different websites and tried to work it out myself), it's mainly the 'mail' function I'm not sure about. Could someone let me know if something's wrong with any of the code please?

 

Thank you for any help.

According to me you must change the sequence of variables. You must check whether the mail is sent successfully or not. For that you can add the below code.

if(!mail($to, $subject, $message, $name)){
    die("Error Sending email");
}else{
    die('Email sent!');
}

You can also look at checking if the email address is actually an email address. Some validation and sanitization would be good practice

Definitely needs sanitisation (checking that the input is what is supposed to be). But that's the gist of it.