[RESOLVED] Send form data to mysql database and email same data

[lightningrod66]

I have a form on our website that a user can fill out for custom product. I want the form data to be 1) stored into a mysql database AND after storing said data, 2) email the same data to our sales department.

1) The form data DOES get stored into mysql database (except for the first two fields, for some weird reason)

2) I added a "mail" section to the php file that stores the data into the database, but it is not working correctly. I have stripped the email portion down to sending just one of the fields in the "message" to make it easier for troubleshooting

I have included here, both the form section of the html file, and the formdata.php file that processes the data for your analysis. I am relatively new to php so there are going to be some issues with security, but I can work on those after I get the store & email process to work correctly. Please review my code and see if anyone can be of assistance. I looked through the forums and couldn't find another issue that was the same as mine. If I just overlooked, please tell me the thread post #. Thanks 🙂

THE FORM WHICH COLLECTS THE DATA

---

<form method=POST action=formdata.php>


  <table width="640" border=0 align="center">
    <tr> 
      <td align=right><b>First Name</b></td>
      <td><input type=text name=FName size=25></td>
      <td><div align="right"><b>Telephone</b></div></td>
      <td><input type=text name=Tel size=25></td>
    </tr>
    <tr> 
      <td align=right><b>Last Name</b></td>
      <td><input type=text name=LName size=25></td>
      <td><div align="right"><b>Fax</b></div></td>
      <td><input type=text name=Fax size=25></td>
    </tr>
    <tr> 
      <td align=right><b>Title</b></td>
      <td><input type=text name=Title size=25></td>
      <td><div align="right"><b>Email</b></div></td>
      <td><input type=text name=Email size=50></td>
    </tr>
    <tr> 
      <td align=right><b>Company</b></td>
      <td><input type=text name=Comp size=25></td>
      <td>&nbsp;</td>
      <td>&nbsp;</td>
    </tr>
    <tr> 
      <td align=right><b>Address</b></td>
      <td><input type=text name=Addr size=25></td>
      <td><div align="right"><b>Estimated Annual Volume</b></div></td>
      <td><input type=text name=EAV size=25></td>
    </tr>
    <tr> 
      <td align=right><b>City</b></td>
      <td><input type=text name=City size=25></td>
      <td>&nbsp;</td>
      <td>&nbsp;</td>
    </tr>
    <tr> 
      <td align=right><b>State/Province</b></td>
      <td><input type=text name=SProv size=25></td>
      <td><div align="right"><b>Application</b></div></td>
      <td><input type=text name=Appl size=25></td>
    </tr>
    <tr> 
      <td align=right><b>Country</b></td>
      <td><input type=text name=Ctry size=25></td>
      <td><div align="right"><b>Type of System</b></div></td>
      <td><input type=text name=Syst size=25></td>
    </tr>
    <tr> 
      <td align=right><b>Zip/Postal Code</b></td>
      <td><input type=text name=ZPC size=25></td>
      <td>&nbsp;</td>
      <td>&nbsp;</td>
    </tr>
    <tr> 
      <td align=right>&nbsp;</td>
      <td>&nbsp;</td>
      <td>&nbsp;</td>
      <td>&nbsp;</td>
    </tr>
    <tr> 
      <td align=right>&nbsp;</td>
      <td><div align="right"><strong><font color="#FFFF00" face="Arial, Helvetica, sans-serif">COIL 
          DESIGN</font></strong></div></td>
      <td><font color="#FFFF00" face="Arial, Helvetica, sans-serif"><strong>PARAMETERS</strong></font></td>
      <td>&nbsp;</td>
    </tr>
    <tr> 
      <td align=right>&nbsp;</td>
      <td>&nbsp;</td>
      <td>&nbsp;</td>
      <td>&nbsp;</td>
    </tr>
    <tr> 
      <td align=right><b>Primary Resistance (ohms)</b></td>
      <td><input type=text name=Pres size=25></td>
      <td><div align="right"><b>Primary Inductance (mH)</b></div></td>
      <td><input type=text name=Pind size=25></td>
    </tr>
    <tr> 
      <td align=right><b>Secondary Resistance (ohms)</b></td>
      <td><input type=text name=Sres size=25></td>
      <td><div align="right"><b>Secondary Inductance (H)</b></div></td>
      <td><input type=text name=Sind size=25></td>
    </tr>
    <tr> 
      <td align=right>&nbsp;</td>
      <td>&nbsp;</td>
      <td>&nbsp;</td>
      <td>&nbsp;</td>
    </tr>
    <tr> 
      <td align=right><b>Peak Operating Current (Amps)</b></td>
      <td><input type=text name=POC size=25></td>
      <td>&nbsp;</td>
      <td>&nbsp;</td>
    </tr>
    <tr> 
      <td align=right>&nbsp;</td>
      <td>&nbsp;</td>
      <td>&nbsp;</td>
      <td>&nbsp;</td>
    </tr>
    <tr> 
      <td align=right><b>Output Energy (mJ)</b></td>
      <td><input type=text name=Egy size=25></td>
      <td><div align="right"><b>Output Voltage (kV)</b></div></td>
      <td><input type=text name=Volt size=25></td>
    </tr>
    <tr> 
      <td align=right>&nbsp;</td>
      <td>&nbsp;</td>
      <td>&nbsp;</td>
      <td>&nbsp;</td>
    </tr>
    <tr> 
      <td align=right><b># HV Towers per Coil</b></td>
      <td><input type=text name=TPC size=25></td>
      <td><div align="right"><b># of Coils per Package</b></div></td>
      <td><input type=text name=CPP size=25></td>
    </tr>
    <tr> 
      <td align=right>&nbsp;</td>
      <td>&nbsp;</td>
      <td>&nbsp;</td>
      <td>&nbsp;</td>
    </tr>
    <tr> 
      <td align=right>&nbsp;</td>
      <td>&nbsp;</td>
      <td>&nbsp;</td>
      <td>&nbsp;</td>
    </tr>
    <tr> 
      <th colspan=4><b>Please enter any additional information here:</b></th>
    </tr>
    <tr> 
      <th colspan=4><textarea name=Mess cols=50 rows=10 id="Message"></textarea></th>
    </tr>
  </table>
  </dl>
  <div align="center">
    <p>
      <input type=hidden name=BodyTag value="&lt;body  bgcolor=&quot;#484589&quot; text=&quot;#FFFFFF&quot; link=&quot;#FFFF00&quot; alink=&quot;#FFFFFF&quot; vlink=&quot;#FF7F00&quot;&gt;">
      <input type=hidden name=FA value=SendMail>
    </p>
    <p><font color="#FFFF00" face="Arial, Helvetica, sans-serif"><strong>PLEASE MAKE SURE ALL 
      INFORMATION<br>
      IS CORRECT BEFORE SUBMITTING</strong></font></p>
    <p> 
      <input type=submit value="Submit Form">
    </p>
  </div>
</form>

THE FILE THAT PROCESSES THE FORM DATA (formdata.php)

---

<?php
$con = mysql_connect("localhost","XXX","XXX");
if (!$con)
  {
  die('Could not connect: ' . mysql_error());
  }

mysql_select_db("customform", $con);

$sql="INSERT INTO formdata (Fname, Lname, Title, Comp, Addr, City, SProv, Ctry, ZPC, Tel, Fax, Email, EAV, Appl, Syst, Pres, Pind, Sres, Sind, POC, Egy, Volt, TPC, CPP, Mess)
VALUES ('$_POST[Fname]','$_POST[Lname]','$_POST[Title]','$_POST[Comp]','$_POST[Addr]','$_POST[City]','$_POST[SProv]','$_POST[Ctry]','$_POST[ZPC]','$_POST[Tel]','$_POST[Fax]','$_POST[Email]','$_POST[EAV]','$_POST[Appl]','$_POST[Syst]','$_POST[Pres]','$_POST[Pind]','$_POST[Sres]','$_POST[Sind]','$_POST[POC]','$_POST[Egy]','$_POST[Volt]','$_POST[TPC]','$_POST[CPP]','$_POST[Mess]')";

if (!mysql_query($sql,$con))
  {
  die('Error: ' . mysql_error());
  }
echo "Your Information Was Successfully Posted";

mysql_close($con);

$to = "recipient email address here"; 
$subject = "Custom Form"; 
$email = $_POST['Email'] ; 
$message = $_POST['Comp'] ; 
$headers = "From: $Email"; 
$sent = mail($to, $subject, $message, $headers) ; 
if($sent) 
{print "Your mail was sent successfully"; }
else 
{print "We encountered an error sending your mail"; }
?>

[nevvermind]

A lil' introduction:

$x = "Benjamin";
$y = array("name" => "Benjamin");

echo "Hi, my name is $x"; // prints ok
echo "Hi, my name is " . $x; //prints ok
echo "Hi, my name is {$x}"; // prints ok

echo "Hi, my name is $y['name']"; // it doesn't work!
echo "Hi, my name is " . $y['name']; // prints ok
echo "Hi, my name is {$y['name']}"; // prints ok

As you can see, the curly brackets are used especially for complex expressions, even for things like:

// a class Student with $name variable
$student = new Student();

echo "Hi, my name is {$student->name}"; // prints ok

That being said, your code should be:

$sql = ... VALUES ('{$_POST['Fname']}','{$_POST['Lname']}','{$_POST['Title']}','{$_POST['Comp']}' ...

[bradgrafelman]

Another form you omitted:

echo "Hi, my name is $y[name]"; // prints ok 

Also, in regards to the SQL query... note that user-supplied data should never be placed directly into a SQL query string, else your code will be vulnerable to SQL injection attacks and/or just plain SQL errors. Instead, you must first sanitize it with a function such as [man]mysql_real_escape_string/man (for string data).

[nevvermind]

bradgrafelman;10962350 wrote:

Another form you omitted:

echo "Hi, my name is $y[name]"; // prints ok 

Point taken. From what I know, that's not good practice. Is it?

[bradgrafelman]

nevvermind wrote:

From what I know, that's not good practice. Is it?

Not sure what you mean... it doesn't cause any PHP error messages, so I would say it's no better or worse than any other method you listed?

[nevvermind]

True. I can't remember right, but not using your style (w\o the quotes, single or double) had something to do with searching a variable, then printing. It's like not wrapping your table names with back ticks: with any "luck", you'll bump into a variable name or some reserved word.

[nevvermind]

Found it!

Why is $foo[bar] wrong?

The reason is that this code has an undefined constant (bar) rather than a string ('bar' - notice the quotes), and PHP may in future define constants which, unfortunately for your code, have the same name. It works because PHP automatically converts a bare string (an unquoted string which does not correspond to any known symbol) into a string which contains the bare string. For instance, if there is no defined constant named bar, then PHP will substitute in the string 'bar' and use that.

Note: This does not mean to always quote the key. You do not want to quote keys which are constants or variables, as this will prevent PHP from interpreting them.

[lightningrod66]

nevvermind;10962341 wrote:

A lil' introduction:

$x = "Benjamin";
$y = array("name" => "Benjamin");

echo "Hi, my name is $x"; // prints ok
echo "Hi, my name is " . $x; //prints ok
echo "Hi, my name is {$x}"; // prints ok

echo "Hi, my name is $y['name']"; // it doesn't work!
echo "Hi, my name is " . $y['name']; // prints ok
echo "Hi, my name is {$y['name']}"; // prints ok

As you can see, the curly brackets are used especially for complex expressions, even for things like:

// a class Student with $name variable
$student = new Student();

echo "Hi, my name is {$student->name}"; // prints ok

That being said, your code should be:

$sql = ... VALUES ('{$_POST['Fname']}','{$_POST['Lname']}','{$_POST['Title']}','{$_POST['Comp']}' ...

Thanks for the tip. Using my code as-is, the form data gets inserted into the database just fine. I know that there are still some security issues I need to work out, but my main issue is trying to get that same data to send email. When I fill out the form and push SUBMIT, I get the following:

Your Information Was Successfully Posted We encountered an error sending your mail.

When I check the database, all the data (with the exception of first name and last name 😕) is there, but I don't get an email. Any idea, based on viewing my code?? Any help appreciated 🙂

[bradgrafelman]

nevvermind;10962426 wrote:

Found it!

That argument doesn't apply to my example; this:

echo $foo[bar];

is not the same as this:

echo "$foo[bar]";

The former causes the error you mentioned above, while the latter is perfectly valid.

[lightningrod66]

This issue was resolved on another forum, but I figured I should post the solution here as well for anyone else who runs into this same problem. It all amounts to case-sensitivity, whereas in one section of code I have capital letters in the variable name, and lower-case in another section. I looked at this at least 2 dozen times and didn't catch it. This is where having another set of eyes (or many sets hehe) can spot a problem that is right in front of our nose 🙂 Thanks to all who replied with tips and/or suggestions!

The actual forum post link is here:

http://www.daniweb.com/forums/post1326332.html#post1326332