PHP Mail Script Problem
I've volunteered for the SPCA and I'm trying to get this script to work; althouth I have it on my own server, it's not working on theirs.
I put a trouble ticket in and they replied that since it was a Charter Account, that they'd need to upgrade in order for advanced scripting to work.
I discussed this with the president of the SPCA and she agreed to upgrade.
Now here's the good part....it still doesn't work
<?
$email = $_request['email'] ;
$message = $_request['message'] ;
mail( "myemailaddress", "feedback form results",
$message, "from: $email" );
header( "location: http://www.spca4pets.org/thankyou.htm" );
?> Can anyone see "anything wrong with this???? I still don't get it...it works on my site
s0da posted this at 02:10 — 4th May 2004.
He has: 157 posts
Joined: Mar 2004
did they give you the error message? or any other information?
Suzanne posted this at 02:11 — 4th May 2004.
She has: 5,507 posts
Joined: Feb 2000
Your version of PHP is different?
$_POST['email'] or $_GET['email']
catarina posted this at 02:12 — 4th May 2004.
She has: 24 posts
Joined: Mar 2004
Yes, sorry I didn't post that.
[Mon May 3 21:53:54 2004] [error] (13)Permission denied: Apache::SubProcess exec of /usr/local/users/bl/s/p/spca4pets/php4.3.3 failed'catarina posted this at 02:14 — 4th May 2004.
She has: 24 posts
Joined: Mar 2004
BTW ~ I'm don't know what that means cause I'm not a programmer...
Suzanne ~ I'm not really sure what you mean, but why would it work on my site and not on theirs
s0da posted this at 02:18 — 4th May 2004.
He has: 157 posts
Joined: Mar 2004
that's doesn't look like it's the scripts fault. could they possibly have something else in there script that is causing the error? maybe placing exit(); below header(); would fix it; IF it's the scripts fault.
catarina posted this at 02:34 — 4th May 2004.
She has: 24 posts
Joined: Mar 2004
s0da ~ do you mean to do this??:
Once again, my apologies...I'm not familiar with this language at all.
s0da posted this at 02:36 — 4th May 2004.
He has: 157 posts
Joined: Mar 2004
yes. are you able to test on there server? or atleast get the server/php config or something.
catarina posted this at 02:40 — 4th May 2004.
She has: 24 posts
Joined: Mar 2004
I don't know ( I feel like such a dumbass) lol ~ I wouldn't even know where to begin. I'll try what you just said and if that doesn't fix it.. I'll be back ~ brb
s0da posted this at 02:53 — 4th May 2004.
He has: 157 posts
Joined: Mar 2004
dont worry it's not your fault at all. all the code above is correct. it'll prolly end up being their fault.
catarina posted this at 03:01 — 4th May 2004.
She has: 24 posts
Joined: Mar 2004
LOL...I guess so, cause I tried another script and that didn't work and it's just so aggravatting grrrrrrr....anyways, thanks alot s0da ~ I hope I hear from them with some explanations as to why this isn't working.
BTW ~ am I supposed to enable something on that site? I tried everything LOL.. I thought everyone had an Apache thingie...LOL I know, I'm so ignorant, but that's okay cause I won't be for long...I really hate not knowing what I'm doing here, but that's why these kinds of boards are really great
s0da posted this at 03:10 — 4th May 2004.
He has: 157 posts
Joined: Mar 2004
nah. i dunno what that error means. but i know it's not the scripts fault.
Suzanne posted this at 11:04 — 4th May 2004.
She has: 5,507 posts
Joined: Feb 2000
It would fail on yours not theirs because different servers have different server configurations.
1. You likely have a different version of PHP on the new server from your own server, and settings in the php.ini vary enough to be causing problems. If $_request['var'] is not working, try changing it to (with all caps) one of these: if the method is post, you'd use $_POST['var'], if the method is get, you'd use $_GET['var']
http://www.php.net/manual/en/reserved.variables.php#reserved.variables.request
http://www.php.net/manual/en/reserved.variables.php#reserved.variables.post
2. The email "script" you're using is very insecure and allows for all sorts of mayhem. There is no data checking at all.
http://www.php.net/manual/en/security.variables.php
3. You should respect the case of these global variables -- $_REQUEST['var'], not $_request['var'] -- as good coding standards
4. You should check to see using phpinfo() whether you have sendmail installed, as well as other configuration changes.
http://www.php.net/phpinfo
***
In general, you shouldn't install scripting that allows user input that doesn't verify and strip that input of dangerous characters.
Suzanne posted this at 11:20 — 4th May 2004.
She has: 5,507 posts
Joined: Feb 2000
Some basic error checking and protection:
<?php
function is_email($email) {
// this just checks that the email is in the right format
return eregi(\"^[a-z\'0-9]+([._-][a-z\'0-9]+)*@([a-z0-9]+([._-][a-z0-9]+))+$\",$email);
}
// strip out bad stuff from $email
$email = trim(stripslashes(strip_tags($_POST['email'])));
if (!is_email($email)) {
// if this isn't in the email format, write an error message
// or you can have it fail by typing exit; (not exit();!)
$emailerror .= '<p><strong>WARNING:</strong> Your email was invalid, please choose “Modify Postcard” to fix it.</p>';
}
// strip out the bad stuff from $message
$message = strip_tags(htmlentities($_POST['message'], ENT_QUOTES));
;
mail( \"myemailaddress\", \"feedback form results\", $message, \"from: $email\" );
header( \"location: http://www.spca4pets.org/thankyou.htm\" );
?>
catarina posted this at 12:20 — 4th May 2004.
She has: 24 posts
Joined: Mar 2004
Suzanne ~ thanks so much for your time in writing that...I truly appeciate it
~
I did get an email from Bizland and they stated that they were "working" on this...so, I'll keep ya'll posted.
In the interium, I'll be snooping about this Board and php tutorials ~ I need to understand this language.
catarina posted this at 01:55 — 5th May 2004.
She has: 24 posts
Joined: Mar 2004
catarina posted this at 03:32 — 11th May 2004.
She has: 24 posts
Joined: Mar 2004
LOL ~ Thanks Suzanne ~ I'm about to committ myself :eek:
Suzanne posted this at 15:38 — 5th May 2004.
She has: 5,507 posts
Joined: Feb 2000
Yes and no. Your script is still very insecure and dangerous as is.
s0da posted this at 17:48 — 5th May 2004.
He has: 157 posts
Joined: Mar 2004
yeah, on the secure aspect. you were using an outside variable (_GET, _POST, _REQUEST) inwich users can take advantage of if the correct measures are not taken care of to prevent such things. i guess for example i could have issued a command to attach /etc/passwd to the message or something where you placed "from: $email".
Links:
[url]http://www.zend.com/zend/art/art-oertli.php]Zend: Secure Programming in PHP[/url]
[url]http://www.google.com/search?hl=en&ie=UTF-8&oe=UTF-8&q=php+security]php security[/url]
[url]http://www.google.com/search?num=20&hl=en&lr=lang_en&ie=UTF-8&oe=UTF-8&newwindow=1&safe=off&c2coff=1&q=php+mysql+security]php mysql security[/url]
catarina posted this at 12:10 — 7th May 2004.
She has: 24 posts
Joined: Mar 2004
s0da ~ Thanks! I'll check out the site. When I ran it; I didn't check my email and to my delight (NOT) there's no results :FAINTS: arrrrrrrgh....I'll definitely check out those links...thanks very much once again
One day I'll be able to relax and stay on this Board for more than a 1/2 hour..
Mark Hensler posted this at 00:31 — 6th May 2004.
He has: 4,048 posts
Joined: Aug 2000
I think the error was caused by a bad apache configuration. The apache user most likely had insufficient permissions to run the php interpreter.
catarina posted this at 12:12 — 7th May 2004.
She has: 24 posts
Joined: Mar 2004
Mark ~ I think you're right about that ~ not that I'd really know, but it appears they were having some type of problems and had to have techs look into it.
Suzanne posted this at 12:22 — 7th May 2004.
She has: 5,507 posts
Joined: Feb 2000
Catarina, I renamed this thread so we all know what it's about instead of feeling like we need to call 911...
catarina posted this at 04:07 — 11th May 2004.
She has: 24 posts
Joined: Mar 2004
Suzanne ~ I used your code and it's working! Thanks so much!!! WOOHOO!!! Now I can have a life LOL HUGs!!
s0da posted this at 04:18 — 11th May 2004.
He has: 157 posts
Joined: Mar 2004
;D hugs!
catarina posted this at 04:26 — 11th May 2004.
She has: 24 posts
Joined: Mar 2004
Hugs to you too s0da!! ...and it's off to the land of nod for me! weee
I'm soooo happy! HAHA....xoxox
Busy posted this at 10:21 — 11th May 2004.
He has: 6,151 posts
Joined: May 2001
s0da's not going to wash for a week now
s0da posted this at 12:09 — 11th May 2004.
He has: 157 posts
Joined: Mar 2004
damn right.. that's free lovin
Suzanne posted this at 15:07 — 11th May 2004.
She has: 5,507 posts
Joined: Feb 2000
lol well, good! At least it's a little more secure, too.
Want to join the discussion? Create an account or log in if you already have one. Joining is fast, free and painless! We’ll even whisk you back here when you’ve finished.