Problems with form mail

[philip31]

I set up a form mail page on my website, using if … else and the isset function.
However, mail is always sent on ‘submit’ regardless of whether the fields in the form have been completed, and thankyou.htm is always returned.

The HTML form script is as follows:

The PHP script is as follows:

<?php
if (isset($_POST['name'], $_POST['email'], $_POST['message']))
{
$senderName = $_POST['name'];
$senderEmail = $_POST['email'];
$senderSubject = $_POST['subject'];
$senderMessage = $_POST['message'];
$to = 'me@domain.name';
mail($to, $senderMessage, $senderEmail);
include 'thankyou.htm';
}
else
{
include 'mail2.php';
}
?>

[Gandalf]

@philip31

if (isset($_POST['name'], $_POST['email'], $_POST['message']))

The preferred way to check if a form has been submitted is

if ($_SERVER['REQUEST_METHOD'] === 'POST')

[Archibald]

@philip31

. . . mail is always sent on ‘submit’ regardless of whether the fields in the form have been completed

The simplest way of ensuring fields are completed is to use the ‘required’ attribute:

HTML input required Attribute

[benanamen]

What you need to understand is that form fields, save for check boxes, are ALWAYS isset therefore checking for it is pointless. You need to trim the entire post array at once and then check for empty.

[SamA74]

@Archibald

The simplest way of ensuring fields are completed is to use the ‘required’ attribute:

Using client side validation like this is helpful and I would recommend it. But it can’t be relied upon, it should be backed up by server side validation too.
Add to that making the input type for email, email, modern browsers will validate client side if you do.

@philip31

if (isset($_POST['name'], $_POST['email'], $_POST['message']))

As mentioned, this won’t work because if they are not filled in, they will still be set, just set as an empty string.

Use the condition @Gandalf posted to confirm form submission, then run the mail script.

@Gandalf

if ($_SERVER['REQUEST_METHOD'] === 'POST')

Begin by validating required inputs.

@philip31

$senderName = $_POST['name'];

This is a waste of code, it does nothing. Try:-

$senderName = trim($_POST['name']);

As @benanamen suggests, then check for empty.

if(empty($senderName)) { $errors[] = "The name input must be completed!" ;}

For email there is a function to validate that.

if(!filter_var($senderEmail, FILTER_VALIDATE_EMAIL)) { $errors[] = "The email address you gave was not valid!" ;}

At the end you can check the error array.

if(!count($errors)){
       // Send the mail
}
else{
    // Display the form again and list the errors on screen
}

If you want to be stricter you can set min and max lengths for the inputs.

[philip31]

Thank you very much for your suggestions. These give me a number of different avenues to explore. I’ll report back after some experimentation

[philip31]

Thank you. Hopefully it’s obvious I’m just starting out learning. I only wish I could find the information you told me more easily. But maybe here I have just found that place!

[philip31]

Thank you. I will give the required attribute a try. Much appreciated!

[philip31]

Thank you! I must say I’m a bit perplexed by ‘preferred’. I was under the impression it either worked or didn’t, and I couldn’t find any errors in my script. But I will definitely experiment with the script sample you offered and report back.

[mabismad]

@philip31

I’m a bit perplexed by ‘preferred’

The purpose of the initial conditional statement of the post method form processing code is to detect when the form has been submitted, so that the processing code will only run if there is data to operate on. That’s the only thing your line of code is doing, to test if 3 of the 4 (presumably ‘subject’ got left out due to the tedium of typing all of that) always-set form fields are set (repeating now, but most form field types will always be set when the form has been submitted, even if they are empty.)

Programming is already a tedious typing activity. If you find yourself repeating elements, lines, and blocks of code that only differ in the variable or value they operate on or have a series of name-numbered things, it is a sign that you are doing something in the hardest way possible. If your form had 30 fields, would writing out 30 entries in the isset() statement or having 30 lines of code copying variables to other variables make sense? Your answer should be no.

The statement testing if the server request method is equal to post, accomplishes testing if a post method form was submitted. This is simple, general-purpose, and reusable.

As to copying a bunch of variables to other variables. If you are not modifying the values at the same time, and are doing this to preserve the original values, it is a waste of time typing. As already mentioned, you should trim all input data before using it, mainly so that you can detect if all white-space characters were entered. If you keep the form data as a set, in an array variable, you can trim it all at once using one single line of code, storing the trimmed working copy in an internal array variable. You would operate on elements of this internal array variable throughout the rest of the script. In addition to savings typing a bunch of lines of code, by keeping the form data as a set, you are now in a position where you can dynamically validate the data, dynamically process the data, and can simply provide an array of data to a html document template to output the data on a web page.

[philip31]

Thank you for taking the time to elaborate. I’m very new to this and a form mail is the first ‘real’ project that I am aiming to set up. Unfortunately, I have seen very few (appropriately simple) examples to work from, so finding this forum has been a great discovery because I am able to benefit from the generosity of you and people like you. Hopefully in time I’ll be able to help you too.

[droopsnoot]

@philip31

Unfortunately, I have seen very few (appropriately simple) examples to work from

The other problem you’ll undoubtedly run in to as you search is that of old out-of-date tutorials that show you how to do stuff in old, out-of-date ways. This is particularly true in database handling - there are many, many tutorials out there that use the old-style mysql_query() and similar functions, which were deprecated for many years, and are now removed from the language. Similarly lots that don’t talk about using Prepared Statements for database handling. A useful skill to develop will be to distinguish a good tutorial from an outdated one.

It’s also only a matter of time before someone recommends that you don’t use the built-in PHP mail() function, and look at using a library such as “PHPMailer” instead, as it’s more reliable and supports more functionality.