Help with PHP form Script

[laurieballard]

Hello

I have a form on my website that runs a php script to email the form to my address. I have managed to get the form to email itself to me but the details do not appear in the email.

Here is the script:

<?php

$emailsubject = 'Contact Form';
$webMaster = '[e-mail]';

$fullname = $_POST['fullname'];
$email = $_POST['email'];
$telnumber = $_POST['telnumber'];
$address1 = $_POST['address1'];
$address2 = $_POST['address2'];
$town = $_POST['town'];
$postcode = $_POST['postcode'];

$machinetype = $_POST['machinetype'];
$os = $_POST['os'];
$querytype = $_POST['querytype'];
$other = $_POST['other'];
$details = $_POST['details'];

$body = <<<EOD

Full Name: $fullname
Email Address: $email
Tel Number : $telnumber
Address Line 1: $address1
Address Line 2: $address2
Town: $town
Postcode: $postcode
Machine Type: $machinetype
Operating System: $os
Query Type: $querytype
Other: $other
Details: $details
EOD;

$headers = "From: $email\r\n";
$headers .= "Content=type: text/html\r\n";

mail($webMaster, $emailsubject, $body, $headers);

header('Location: thanks.html');

?>

Obviously i have made sure al the variable names are correct. This is all i get in the email:

-----Original Message-----
From:
Sent: 23 July 2008 19:27
To: [e-mail]
Subject: Contact Form

Full Name:
Email Address:
Tel Number :
Address Line 1:
Address Line 2:
Town:
Postcode:
Machine Type:
Operating System:
Query Type:
Other:
Details:

The php script is obviously being processed when the users clicks submit but the details the user types in are not being sent with the form. Any help would be apreciated.

The form actual is here:

http://www.complain2.co.uk/pcsite/quote.html

[bretticus]

Use Heredoc notation instead of Nowdoc (since you cannot use variables in Nowdoc just like single quoted strings.

$body = <<<EOT
Full Name: $fullname
Email Address: $email
Tel Number : $telnumber
Address Line 1: $address1
Address Line 2: $address2
Town: $town
Postcode: $postcode
Machine Type: $machinetype
Operating System: $os
Query Type: $querytype
Other: $other
Details: $details
EOT;

[bradgrafelman]

The issue isn't with your variables, it's with your form; check the <form> tag in the HTML, I believe "methos" should be "method". 🙂

Also:

a) If a bot crawls your script, a blank e-mail will be sent; your script doesn't verify that any data was actually submitted before it tries to use the $_POST variables.

b) Your contact form is vulnerable of e-mail header injections, meaning that spam bots can exploit your script to send e-mail to hundreds of users most likely until either your host disables your account or your host is blacklisted as an open relay.

[bretticus]

Ooops! To further amend my bad advice (what I get for quickly perusing the manual and giving advice on a feature I do not use) the difference between heredoc and nowdoc is that, in nowdoc, the identifier (EOD or EOT) is wrapped in single quotes <<<'EOT'. I was confusing the identifiers with defining heredoc and nowdoc. Not so! The only part I got right is that no parsing is done in nowdoc (which I assumed was the issue.)