Email form

darnell

Hello, I'm fairly new to PHP

Im trying to make this

echo "<a href=\"mailto: ".$myrow['email']."\">".$myrow['email'];
echo "</a><br>";}

into something like a simple email form that would send an email to that email address from the database.

Any help is appreciated, Thanks

NogDog

Here's a generic PHP email form page I created a few years ago: http://www.charles-reace.com/PHP_and_MySQL/Contact_Form/contact.txt

bradgrafelman

NogDog;10980677 wrote:
Here's a generic PHP email form page I created a few years ago: http://www.charles-reace.com/PHP_and_MySQL/Contact_Form/contact.txt

Except you've used the user-supplied e-mail address in the 'From' header, which is a good way to become an open mail relay and added to one or more RBLs. 😉

NogDog

I told you it was a few years old. :p

Guess I'll add updating that page again to my to-do list.

Derokorian

I don't understand, why is putting user supplied email bad if its only going to be sent to the same email address no matter what they input?

NogDog

Derokorian;10980682 wrote:
I don't understand, why is putting user supplied email bad if its only going to be sent to the same email address no matter what they input?

Any value that will be used in the email headers (including subject) can be used to inject additional headers, allowing someone to hijack your mail form to send spam. E.g.:

$subject = "blah blah\r\nReply-To: real-email@example.com\r\n\r\nSpam message text here";

Derokorian

Isn't that why we filter / sanitize input tho?

bradgrafelman

The point I was making had nothing to do with header injections (which is a very valid concern as well, however).

Putting a user-supplied e-mail address in the 'From' header is forgery; the e-mail you're sending didn't originate from an MX responsible for that domain (unless they happen to have a mailbox on your server, of course). Sending forged e-mails - no matter the destination - is never a good idea IMHO.

Derokorian

Thank you for clearing that up, reply-to: is valid tho yes?

bradgrafelman

Actually, I take that back... apparently I've had it wrong all along. The "From" field can contain anyone's address; the "Sender" header, however, should indicate who the message originated from (e.g. your server). Apparently MTAs just assume that the Sender is the same as the From header if the former is not explicitly stated.

NogDog

Some sendmail implementations are configured to return an error and not send the mail if the From: header is not a valid email on that host, while some are not, so some web hosts may let you get away with it and others won't.