Form won't send

[ThaVincy]

Hi all,

I'm using the same (variation of) script for years to send out forms to an email address, and what strikes me is that one one site it works perfect the first time, while the other site needs countless adaptations, alltough they are hosted on the same servers.

For instance, here is my form code, saved as "main.php" and embedded in an index as such: http://www.site.com/contact/index.php?id=main

<?php
      if (!empty($_POST['Submit'])) {
      $to = "me@address.com";
      mail("$to", "Email subject", "Check this message out.\n\nNaam: " . $_POST['name'] . "\nVoornaam: " . $_POST['firstname'] . "\nFirma: " . $_POST['company'] . "\n\nTelefoon: " . $_POST['phone'] . "\nEmail: " . $_POST['email'] . "\n\nMessage: " . $_POST['message'], "From: My website\r\n"
      ."Reply-To: $email\r\n"
      ."X-Mailer: PHP/" . phpversion());
 
      header ("Location: http://www.site.com/contact/index.php?id=thanks");
      exit;
      }
      ?>
 
      <form method="post" action="<?php echo $_SERVER['PHP_SELF']; ?>">
        <div>
        <label><?php print($lan[162]);?></label>
        <input type="text" name="name" id="name" class="forms"> 
        </div>
        <div>
        <label><?php print($lan[163]);?></label>
        <input type="text" name="firstname" id="firstname" class="forms"> 
        </div>
        <div>
        <label><?php print($lan[164]);?></label>
        <input type="text" name="company" id="company" class="forms"> 
        </div>
        <p>&nbsp;</p>
        <div>
        <label><?php print($lan[165]);?></label>
        <input type="text" name="email" id="email" class="forms"> 
        </div>
        <div>
        <label><?php print($lan[166]);?></label>
        <input type="text" name="phone" id="phone" class="forms"> 
        </div>
        <div>
        <label><?php print($lan[167]);?></label>
        <textarea name="message" id="message"></textarea> 
        </div>
        <div><input type="submit" class="buttons" value=" <?php print($lan[168]);?> "></div>
        </form>

In this case, the form won't send or show me the thanks.php page, alltought I've copied it right from another (working!) project.

What am I doing wrong? Can anyone point out the mistake here so I can stop losing time every time it fails on me?

Thanks in advance.

[joaquin_win]

What is the actual HTML output generated?

You might want to leave action empty (i.e. <form action="" ...) since you want to send everything to the current URL.

Also, is the form being submitted and no data received or the page isn't even reloading?

[SJH]

You might want to leave action empty (i.e. <form action="" ...) since you want to send everything to the current URL.

Careful doing this. The action attribute is required, and while omitting it may have the desired effect in some browsers, it's not guaranteed to work for everyone.

Edit: w00t 2000 posts

[ThaVincy]

The page does refresh, with empty fields, like I've just hit the F5 button in stead of the submit button.

When I look at the HTML output I can see this:

<form method="post" action="http://www.site.com/contact/index.php">

And the rest of the form. The PHP-part at the top is not visible offcourse.

[ThaVincy]

Edit: w00t 2000 posts

Congrats

[joaquin_win]

Yes you're right SJH (and congrats on your 2000th post), but I just wanted to work with the little info given by ThaVincy. The actual output would be nice, I don't see anything blatantly wrong in the form.

ThaVincy, you should also use the for attribute in the label tag to associate inputs and labels (proximity doesn't mean anything): http://htmldog.com/reference/htmltags/label/

And if you are using xhtml correctly close the input tags <input ... />

[joaquin_win]

The page does refresh, with empty fields, like I've just hit the F5 button in stead of the submit button.

When I look at the HTML output I can see this:

<form method="post" action="http://www.site.com/contact/index.php">

And the rest of the form. The PHP-part at the top is not visible offcourse.

So you are missing the ?main at the end of the URL in the action attribute, you might want to check that.

[decowski]

The action attribute is required, and while omitting it may have the desired effect in some browsers, it's not guaranteed to work for everyone.

But joaquin_win didn't suggest ommiting it; he suggested leaving it empty, which is allowed.

[...] A URI reference that does not contain a URI is a reference to the current document [...]

[joaquin_win]

But joaquin_win didn't suggest ommiting it; he suggested leaving it empty, which is allowed.

Yes decowski, and thanks to come in my defense :P You made me actually read the spec:

HTML spec says

action = uri [CT]
This attribute specifies a form processing agent. User agent behavior for a value other than an HTTP URI is undefined.

http://www.w3.org/TR/html401/interac...ml#adef-action

An empty value is considered a valid HTTP URI (as I understand from section 5.2 of http://www.ietf.org/rfc/rfc1808.txt) although considered abnormal it is valid. And should resolve to the current url (RFC1808 indicates the normal example would be to use the dot to indicate the current url: .)

(Sorry ThaVincy for steering this post out of topic)

[ThaVincy]

So you are missing the ?main at the end of the URL in the action attribute, you might want to check that.

Right, but that shouldn't change anything (and I checked, it doesn't ), as the code used to "embed" these subpages in the index.php loads the main.php by default:

    <?php
    if (isset($_GET['id'])) 
    { 
    switch($_GET['id']) 
    { 
    case 'thanks' : include('thanks.php'); break; 
    } 
    } 
    else { include('main.php'); } 
    ?>

[joaquin_win]

Ok, I think I know why it isn't processing the data.

You have a

 if (!empty($_POST['Submit'])) { 

But you don't actually have any input field with name="Submit", maybe change it to:

 if (!empty($_POST)) { 

do a var_dump($_POST); to check if you're actually receiving any data. And to have the fields filled if the post fails use the value attribute for the input fields

[ThaVincy]

maybe change it to:

 if (!empty($_POST)) { 

YOU sir, are my hero. That's it! Off course!

That's why some of the times I used this script it worked right away (because the button said "submit") and sometimes it doesn't.

I'll keep that in mind and promise never to look over that line any more!

Thanks.

[joaquin_win]

Cool!

On another note, you should read a little bit about data sanitation and email injection. That script for sending emails is not safe.

Cheers!

[ThaVincy]

What do you mean? As far as I understand, this script does not collect data on the server or in a database, but just sends it as plain text to an email address. There should be no actual trace on the server, right? It's a contact form, so there is no real sensitive information (such as payment info) sent by the user.

[joaquin_win]

An attacker could place specific values in the fields that could allow them to send spam emails to other addresses.

For example, if the attacker sets $_POST['name'] to be:

blah&#37;0ASubject:SpammerSubject%0Abcc:victim@domain2.tld

He would be adding more headers to the email: see the bcc there and a new subject. They could also add attachments and even a new body (by adding two line breaks with %0A)

The spammy emails will be seen as going out of your server.

[ThaVincy]

I see...

Brand new information for me. I'll look into that!

[joaquin_win]

Sure,

Good luck!

[SJH]

But joaquin_win didn't suggest ommiting it; he suggested leaving it empty, which is allowed.

Wow, I really did not know that. Thanks for the heads-up

[joaquin_win]

Wow, I really did not know that. Thanks for the heads-up

It seems to work, I've used it for some time with no problems.

Cheers