Slashes in HTML mail?

Question

I'm trying to write an html mail sender but I have a problem, it shows slashes.

Part of my code:

<?php
$sender = $_REQUEST["sender"];
$to = $_REQUEST["to"];
$html = $_REQUEST["html"];
$send = $_REQUEST["send"];

$headers  = 'MIME-Version: 1.0' . "\r\n";
$headers .= 'Content-type: text/html; charset=' . $ce . "\r\n";

$headers .= 'To: ' . $to . "\r\n";
$headers .= 'From: ' . $sender . "\r\n";

mail($to, $title, $html, $headers);

?>

    <form action="html.php" method="post">
        Sender: <input type="text" name="sender" value="[email protected]">
        HTML content: <textarea cols="40" rows="5" name="html"></textarea>
        <input type="submit" value="Send">
    </form> 

When I type an html code to the textare and send it to gmail, it show weird slashes. What mistake I'm making here?

Answer 1

Your PHP Settings are wrong, there's a setting like *magic_quotes* or someting, you have to disable this.

Answer 2

Try using php functions to convert html. There are quite a few. You might need to encode, decode.

$html = htmlspecialchars($_REQUEST["html"]);

Answer 3

Sounds like Magic Quotes are enabled: http://www.php.net/manual/en/security.magicquotes.php

Either disable Magic Quotes or do this:

$html = stripslashes($_REQUEST["html"]);

Also, if your script uses a from and to address from the form submission, you WILL be found by spammers who will send thousands of emails through your server until you are blocked by every spam blocker on the internet. You need to lock that down.

Any information you add to the mail header from a submission can be compromised, see this for more information: http://www.phpsecure.info/v2/article/MailHeadersInject.en.php