Anyone else have this problem w/double quotes?

slash5

Hi,

This is really annoying cos it seems so easy.
I've created two php files: One with a form, and the second with a preview page that displays the submitted data from that form. The second file also contains a mail function which is called when the user clicks send if they're happy with the preview. Then the submitted data gets sent to my email address. Pretty straight forward, right?

My problem happens if the user has written something that contains double quotes when they filled out the form. Anything between double quotes AND after will not display when the data is emailed to me. WHY?

Single quotes work fine. It's just the double quotes.

EXAMPLE

If the user writes:
Hello there "how are you" ?

All I get sent is:
Hello there

This is the contents of the mail function that sends the email:

 				$_POST['username'] = stripslashes($_POST['username']);
     			$username = $_POST['username'];
    			$_POST['useremail'] = stripslashes($_POST['useremail']);
     			$useremail = $_POST['useremail'];
     			$_POST['userphone'] = stripslashes($_POST['userphone']);
     			$userphone = $_POST['userphone'];
     			$_POST['comments'] = stripslashes($_POST['comments']);
     			$comments = $_POST['comments'];
 		     $mailto = "myname@somewhere.com";
			 $subject = "Website feedback";
			 $message = "This Feedback was sent by:\n" .
						"$username\n" .
						"---------Website Feedback and Enquiries---------\n\n" .
						"Website user name:\n" . "$username" .	
						"\nWebsite user email address is: \n" . " $useremail" .
						"\nWebsite user phone number:\n" . "$userphone" .
						"\nFeedback:\n" . "$comments" .
						"\n\n------------------------------------------------------------\n" ;


	$success = mail($mailto, $subject, $message, "From: \"$username\" <$useremail>\nReply-To: \"$username\" <$useremail>");
	if ($success) {
	header ("location:[url]http://www.somewhere.com/thanks.html[/url]");
	}
	else header ("location:[url]http://www.somewhere.com/error.html[/url]");
     }

To display the preview page I send all of the submitted data from page one through a validation function in page two. The data comes out of the validation as a variable and that variable is displayed in the preview message. So is the above code the right way to send that data to my email address??

Surely it's not that complicated to solve,

Thanks for any help.

TheDefender

No, it's not that hard... [man]addslashes/man

slash5

Hi TheDefender,

I tried your idea but if I use addslashes() I get this: hello there ////// in my email.

This is what I've been doing:

PAGE TWO LOOKS LIKE THIS

<?
if ($q == "send" ) feedback_send();

$comments = stripslashes($_POST['comments']);

?>

HTML form...

<td valign="top" height="100" width="250"><div align="left">
<input type="hidden" name="comments" value="<? echo $comments ?>">
<font color="ffffff" face="arial" size="-1"><? echo $comments ?> 
</font>
</div></td>

more HTML...

 <input type="hidden" name="q" value="send" />

<?
function feedback_send(){

global $username, $useremail, $userphone, $comments;



	     $mailto = "myname@somewhere.com";
		 $subject = "Website feedback and enquiries";
		 $message = "This Feedback was sent by:\n" .
					"$username\n" .
					"---------Website Feedback and Enquiries---------\n\n" .
					"Website user name:\n" . "$username" .	
					"\nWebsite user email address is: \n" . " $useremail" .
					"\nWebsite user phone number:\n" . "$userphone" .
					"\nFeedback:\n" . "$comments" .
					"\n\n------------------------------------------------------------\n" ;


	$success = mail($mailto, $subject, $message, "From: \"$username\" <$useremail>\nReply-To: \"$username\" <$useremail>");
	if ($success) {
	header ("location:[url]http://www.somewhere.com/thankyou.php[/url]");
	}
	else header ("location:[url]http://www.somewhere.com/error.php[/url]");
     }          


?>

Is this the right idea of how to do it?

TheDefender

$comments = stripslashes(addslashes($_POST['comments']));

Is it the comments you are talking about?

slash5

DaMn!

I tried $comments = stripslashes(addslashes($_POST['comments']));

But it still just sends me: hello there /// instead of: hello there "how are you"

In other words it's happy to send me the actual slashes but no text and no quotes. Weird!

apzer0

Use htmlentities(), works fine for me 😉

slash5

If I use htmlentities() i get sent: Hello "double quote entity" there "double quote entity"

I was hoping to get sent Hello "there" if the user types that.

For some strange reason it just won't send the actual double quotation marks.

Mordecai

A bit off the subject, but another error in your script:

header ("location:<a href="http://www.somewhere.com/thankyou.php" target="_blank">[url]http://www.somewhere.com/thankyou.php[/url]</a>");

There is no "location" header. You want "Location."
There must be a space after the colon.
You cannot send HTML here, you must send a full URI.
[/list=1]

Goes for all of your header()s.

TheDefender

How many times are these comments being posted through forms? That is entirely too many slashes for one single post anyhow. You have to keep up with the slashes from the first time it gets posted....

Also, on a side note (ala Mordecai)

else header ("location:<a href="http://www.somewhere.com/error.php" target="_blank">http://www.somewhere.com/error.php</a>");
}

needs the open curly brace after your else... along with the changes Mordecai mentioned.

slash5

Thanks guys but that header is working fine and isn't the thing that caused the problem I asked about. There was extra stuff added automatically by this website when I cut and pasted the code into the php pop up window when I posted it the first message.

Mordecai

Well even if it just added the HTML, there is no "location" header. Need that capital L.

Paul_Jr

Originally posted by Mordecai
Well even if it just added the HTML, there is no "location" header. Need that capital L.

Why? There is nothing in the manual about the "Location:" header being case-sensitive, and I've never had a problem using a lower-case L -- I've also tested out removing the space after the colon, and no problems occurred.

To the OP: Why do you keep calling strip_slashes() on the user input coming from the form? You only need to call strip_slashes() on data that has previously been run through addslashes() -- which is, in fact, the function you are looking for to preserve your quotations.