PHP and mail issue

[wfoster]

Hi,

I am trying to get a e-mail form working but upon submitting the form, mail_send.php goes blank. I'm now showing you the contact form.

<?php
require "header.php";
?>

<center>
<span class="title">CONTACT</span>
<br />
<span class="desc">NEED TO TALK? JUST E-MAIL ME HERE</span>
</center>
<br><br>
<table width="400" class="content" bordercolor="black" border="1" align="center" cellpadding="0" cellspacing="1">
<form action="mail_send.php" method="post">
  <tr>
  <td>Your name:
  <input type="text" id="name" name="name" />
  </td>
  </tr>
  <tr>
  <td>
   Your e-mail: 
  <input type="text" id="email" name="email" />
  </td>
  <tr>
  <td>
    The subject:
  <input type="text" id="topic" name="topic" /></td>
  </tr>
  <tr>
<td>
    Your message:
  <textarea id="comments" name="comments" rows="5" cols="30"></textarea></td>
  <tr>
  <td>
  <button type="submit">Send</button>
  </td>
  </tr>
</form>
</table>

<?php
require "footer.php";
?>

And this is the mail_send.php form

<?php 
require "header.php";
?>

<center>
<span class="title">PROCESSING...</span>
<br />
<span class="desc">YOUR E-MAIL IS PROCESSING</span>
</center>
<br><br>

<?php

$name = $_POST['name'];
$email = $_POST['email'];
$topic = $_POST['topic'];
$comments = $_POST['comments'];


$to = 'wes@wfoster.co.uk';
$subject = "New message: $topic";
$message = "$name said: $comments";
$headers = "From: $email";

// Send the mail using PHPs mail() function
mail($to, $subject, $message, $headers);

// Redirect
header("Location: success.php");

<?php
require "footer.php";
?>

Does anyone know why this isn't working? Idiotic question, I know.

Thank you.

 

[angelwatt]

First, the more direct answer, you can't use the header function after you've already outputted something to the screen. In the file mail_send.php you output the header and all that such then at the bottom you try to redirect, but that's not allowed. Scrap all of the output as it wouldn't be seen anyways as you are redirecting. See the header manual page for more info.

A second note, you are grabbing the values from the form directly without validating the data at all. A malicious script could turn your page into a spam machine, which could potentially get you into trouble as it would be originating from you site. Below is some reading on the subject and methods to safeguard your form.

• http://www.elliotswan.com/2005/09/1...ail-function-add-some-security-to-that-thing/
• http://phpsec.org/projects/guide/1.html
• http://www.phpbuilder.com/columns/ian_gilfillan20060412.php3