[RESOLVED] Building a Header

[Dang]

I'm not even going to say it, you'll see it in my first few words (i'm new to this stuff).

Any way, I am trying to build header information for a mail function. I want to have Cc, Bcc and From headers
Here's how I was going about it, but it wasn't working:

if($name && $email && $note && $referred) {

$headers ='Bcc:[e-mail]\r\n';
$headers .='Cc:$email\r\n';

(I'm leaving the $body out here)

mail('[e-mail]','Request For Contact',$body,$headers);

The general idea is I want to use the variables in the headers as well as fixed text in some cases. I have had luck using one header at a time, but not more than on (concantinating the headers).

I hope I have given enough info.

Thank you

[NogDog]

The sendmail that mail() calls can be sensitive to the From: header used. If you don't explicitly provide one in the additional headers parameter, it will use the default one from your PHP config (assuming one has been set). Most servers will not send the mail if that From: address is not a valid email account on that server, so you want to make sure it's right.

I usually use the following header setup:

$headers  = "From: [e-mail]\r\n"; // must be valid on this host
$headers .= "Reply-To: [e-mail]\r\n"; // might be the same as From:
$headers .= "Cc: [e-mail]\r\n";  // only if needed
$headers .= "Bcc: [e-mail]\r\n"; //  ditto
$headers .= "X-Mailer: PHP/" . phpversion();
mail($to, $subj, $body, $headers);

[Dang]

Thank you

I have a couple of questions:
How do I use one of my field values (from the form) to provide the email address on one of the header?

Aside from the "From" advise (which I have successfully passed by itself) how is yours constructed differently from what I was doing? (am I missing a comma...?)

What does the X-mailer header do?

Again thank you very much.

[NogDog]

I think your syntax was OK - it was mainly the lack of a "From" address in the headers that I was concerned about.

Frankly, email protocols are not my strong point, so the only reason I use the "X-Mailer" header is because the mail() manual page uses it. 🙂 In fact, most of the time I just use the phpMailer class and let it handle the details. 🙂

As far as using user-supplied data, I would make sure there are no newlines in the value (to prevent mailer hijacking by spammers):

$headers .= "Reply-To: " . preg_replace('/[\r\n]/', '', $_POST['email']) . "\r\n";

[Dang]

I pretty much copy/pasted what you had and modified it.
It works great! But for me it doesn't end there...Lucy, you got some splainin' to do (only if you want)!

I am so new and I am actually working on my first web site EVER! (www.completeniche.com)

I just learned html and css a year ago and here I am now. My workmate is starting his own business and I had the opportunity to apply some of what I have learned and so I am winging it (and on a deadline).

I looked up the preg_replace function and was trying to break it down. And here I am, back to asking you questions. What is that all about, I assume some security measure for hijackers but I am unable to get the jist of it as a whole.

Thank you

[NogDog]

If you don't "sanitize" the values from your input form, a spammer could conceivably use it to send spam. For instance, he could send you the same post values that your form expects, except make his email address look like:

[e-mail]\r\nBcc: [e-mail],[e-mail],....<etc.>...

Now if you were to just throw that into your additional headers field, suddenly your message is being spammed out to all the Bcc addresses he threw in. So my little preg_replace() call is simply looking for any occurrence of the "\r" or "\n" characters, which have no place in an email address, and stripping them out of the supplied value. It might still end up being a junk value, but it will then just be an invalid email address, not a bunch of Bcc email addressed injected into your mail processing. The same should be done for any user-supplied data used for the "subject" parameter. (The message portion comes after the mail headers are terminated, so you don't have to worry about them there.)

[Dang]

Thank you for taking the time to explain the concept.
I think I got the idea now.

I have a lot of learning ahead of me.

Thanks!