Form data stripped from emails!

webmistress00

Hey everybody,

I've got a very simple PHP email form that works fine when I fill it out, but when a friend of mine fills it out, it comes into the email with all the data stripped out! No name, no address, nothing but the field names I have in the php file.

I'm thinking it has to do with either the browser security settings or a firewall, but I am SO new to PHP, I'm resorting to the experts.

Anybody? 🙂

bradgrafelman

Well, this is a hard problem to resolve, since it's not readily testable by you. For starters, is there any chance you can provide us with a link as well as the source code of this script?

webmistress00

The form is here:

www.wildriversfishingservice.com/reservations.html

And here is the code from the PHP file: (I removed the actual email address from the code here)

<?php

$name=$POST['name'];
$phone=$POST['phone'];
$address=$POST['address'];
$city=$POST['city'];
$state=$POST['state'];
$zip=$POST['zip'];
$country=$POST['country'];
$email=$POST['email'];
$month=$POST['month'];
$day=$POST['day'];
$triplength=$POST['triplength'];
$adultguests=$POST['adultguests'];
$childguests=$POST['childguests'];
$comments=$POST['comments'];

$to = "email@myemail.com";
$subject = "Reservation Request from Website";
$body = "$name has requested a reservation for:

$month $day $triplength
for $adultguests adults and $childguests children.

Their contact information is:

$address
$city $state $zip $country
$phone
$email

They made the following comments:
$comments";
$headers = "From: email@myemail.com";
mail($to,$subject,$body,$headers);

echo "You have requested a trip on " . $month . " " . $day . " for " . $adultguests . " adults and " . $childguests . " children.<br/>";
echo "Thank you, we will respond to your request shortly!"

;
?>

Okay... so what have I done wrong? 😕

bradgrafelman

Okay... so you have an echo statement in there that also shows them the information? That's good. When your friend submits the form... what does that show up as? No info as well, e.g. "requested a trip on for adults and " etc. ?

EDIT: Also, I just submitted the form twice - once in IE6 and once in FireFox. Your form looks normal... not really any extra junk to weed through, but just in case, can you double check that you got both e-mails and that both were populated with test data?

webmistress00

I received the emails perfectly, all populated normally.

I'm glad to see my coding was right -- so does this mean that something else could be stripping the results, like my friend's own browser or firewall or something? I just shot her over an email asking her questions about the confirmation message, browser and firewall, so we'll see what she says.

bradgrafelman

webmistress00 wrote:
so does this mean that something else could be stripping the results, like my friend's own browser or firewall or something?

In my opinion, this means it's very likely the problem lies with one of the things you mentioned.

webmistress00

Well folks, it looks like we still don't have a resolution for this one. The online forms submit just fine for me, my crew, and even random friends and family I've had test it. Brad (thank you, Brad) has confirmed it's not the code.

But the owner of the website the form is on (and a few customers of theirs), can't submit the form without it coming through with stripped data. Something is removing the data from the form.

Which means that something like the firewall or browser is doing it. They are using AOL, Internet Explorer, and Norton IS. (just FYI, I use Norton IS as well; no issues). I'm baffled and I'm searching the web like a maniac to see if anyone knows of a security setting that would strip the form data.

Does ANYONE have any wild ideas here?

bradgrafelman

EDIT: To preface this post, make sure you read points #2 and #2a first, as the two will probably solve your error.

webmistress00 wrote:
Does ANYONE have any wild ideas here?

Sure, here's a wild one (or two)...

Change your form tag to look like this:

   <form name="reservations" method="post" action="process.php" enctype="multipart/formdata">

Look at the comments made on this page and fix all of them.
---2a. Looking at that page myself, I see a problem that might just fix your error. Look at this line:
```
<select name="day" id="day" required="yes" message="You must enter the date of your desired trip!>
```
Notice anything missing? The validator's error message should help you, if you don't: "literal is missing closing delimiter."
---2b. What is with all of the required="yes" and message="blah.." stuff? You do realize that both of those tags do absolutely nothing. In fact, they do less than nothing - they cause many errors to spew from W3C's HTML validator (and rightly so, since these attributes don't exist).

webmistress00

Okay, as of this morning we have now officially narrowed it down... it's definitely the firewall. I had them turn off their firewall for 5 minutes and try submitting the form again... and guess what. It came through beautifully. Now it's just a matter of figuring out what setting in the firewall is doing it.

But getting back to my coding... I fixed the form tag to include the encoding type. The "required" tags-- I wanted to make the fields required but it's obviously different in PHP-- so what do I do to those fields to make them required fields?

WDPEjoe

A. Mark them visually (with an asterisk or something).
B. Validate the [length/selection/value] in Javascript using the onsubmit and the ids you set (optional)
C. Validate the [length/selection/value] in PHP (not optional -- data validation should always be done)
D. If there are any invalid data, return them to the form and have them resubmit until it's right.

bradgrafelman

As WDPEjoe points out, though you can validate data on the client-side, you should never rely on it - do validation server-side. Use things like [man]empty/man (possibly after using [man]trim/man to cut off the garbage) to check for required data. Use things like [man]intval/man if you're expecting numbers.

You said their firewall is causing all of these headaches? Any chance it's Norton? :p

Weedpacket

webmistress00 wrote:
-- I wanted to make the fields required but it's obviously different in PHP--

What mechanism does need those attributes inserted? Since they don't mean anything in HTML, they'll have no effect on the browser unless there's a load of client-side scripting to go with it.

webmistress00

Silly Wabbit... of COURSE it's Norton! ;-P

I don't think a firewall exists that can outdo Norton's when it comes to real pain-in-the-a$$ issues.... whoops, I didn't say that... ;-)

And thanks, boys, for all the good code suggestions.. I'll be back when I figure out which setting in the firewall does this....