User Recommendation Email Body

views:

answers:

User Recommendation Email Body

Hello,

The code below works great. It allows a user to send emails to other people in order to recommend my site.

How can I replace "Michael" below with $_POST['sendername']? I tried and it didn't work.

Thanks in advance,

John

 $msg = "<html><body>Hello, your friend Michael recommends that you use <a href='http://www.site.com/'&gt;site.com&lt;/a&gt;  Please visit the site.<br><br><img src='http://site.com/images/blacklogo.PNG'&gt;&lt;/body&gt;&lt;/html&gt;";
    $subject = "Try out Site.com";
    $headers  = 'MIME-Version: 1.0' . "\r\n";
    $headers .= 'Content-type: text/html; charset=iso-8859-1' . "\r\n";
    $headers .= 'From: ' . $_POST['sendername'] . "\r\n";
    foreach($_POST['email'] as $email){
    mail($email, $subject,$msg,$headers);
    }

+3 A:

Simply:

 $msg = "<html><body> … ".htmlspecialchars($_POST['sendername'])." … </body></html>";

Gumbo 2009-09-15 07:31:36

...and just make sure you sanitize the input variables first. Don't take them straight from $_POST or you're just begging to be spam-hacked.

da5id 2009-09-15 07:35:32

how can I sanitize it?

John 2009-09-15 07:43:48

Gumbo, it works with double-quotes, ".htmlspecialchars($_POST['sendername'])."I gave you credit.

John 2009-09-15 07:48:11

@John: As the value of `$_POST['sendername']` is supposed to be used as the sender’s e-mail address, you should validate that value to be a valid e-mail address.

Gumbo 2009-09-15 07:50:35

@John I normally include a script like that found at http://www.alt-php-faq.org/local/115/ at the top of all forms processing scripts. You also need to run all your $_POST variables through strip_tags, though there are more comprehensive sanitization methods - a Google search should see you right.

da5id 2009-09-16 23:19:45

@da5id: I wouldn’t use that script. It will rather block fair people than spammers.

Gumbo 2009-09-17 07:06:52

ansaurus

tags:

views:

answers:

User Recommendation Email Body

related questions