views:

25

answers:

2

I'm using mail() function on my feedback page.

There are 3 fields: Name, Mail and Message.

Want to add new field - File, with the ability to upload files and send them to my email.

Some limits:

  1. .zip and .rar files only allowed
  2. file can't be more than 200kb in size.

How to do this and prevent security holes?

+2  A: 

To learn about file uploads, see Handling file uploads in the PHP manual

To send E-Mail with attachments, using a PHP class like Swiftmailer instead of mail() is a good idea.

Pekka
+1 or `Zend_Mail` :) http://framework.zend.com/manual/en/zend.mail.html
robertbasic
@robertbasic: +1 for suggesting Zend_Mail :)
Phliplip
some easier solution? including large library for a simple file upload not a good solution. I need it for only one page on a small site.
Happy
@WorkingHard you can use @JapanPro's code to send the mail, but if you ask me, do yourself a favour and use a ready-made library. Who cares about the few kilobytes the library takes?
Pekka
@WorkingHard: Now i understand why your name is WorkingHard. There's no need to use the entire ZendFramework library, it's a loosely-coupled component library. So you can use only the bits you need. Start using a library, and change your name to WorkingSmart :-)
Phliplip
+1  A: 
//you can use this function
    function mail_file( $to, $subject, $messagehtml, $from, $fileatt, $replyto="" ) {
            // handles mime type for better receiving
            $ext = strrchr( $fileatt , '.');
            $ftype = "";
            if ($ext == ".doc") $ftype = "application/msword";
            if ($ext == ".jpg") $ftype = "image/jpeg";
            if ($ext == ".gif") $ftype = "image/gif";
            if ($ext == ".zip") $ftype = "application/zip";
            if ($ext == ".pdf") $ftype = "application/pdf";
            if ($ftype=="") $ftype = "application/octet-stream";

            // read file into $data var
            $file = fopen($fileatt, "rb");
            $data = fread($file,  filesize( $fileatt ) );
            fclose($file);

            // split the file into chunks for attaching
            $content = chunk_split(base64_encode($data));
            $uid = md5(uniqid(time()));

            // build the headers for attachment and html
            $h = "From: $from\r\n";
            if ($replyto) $h .= "Reply-To: ".$replyto."\r\n";
            $h .= "MIME-Version: 1.0\r\n";
            $h .= "Content-Type: multipart/mixed; boundary=\"".$uid."\"\r\n\r\n";
            $h .= "This is a multi-part message in MIME format.\r\n";
            $h .= "--".$uid."\r\n";
            $h .= "Content-type:text/html; charset=iso-8859-1\r\n";
            $h .= "Content-Transfer-Encoding: 7bit\r\n\r\n";
            $h .= $messagehtml."\r\n\r\n";
            $h .= "--".$uid."\r\n";
            $h .= "Content-Type: ".$ftype."; name=\"".basename($fileatt)."\"\r\n";
            $h .= "Content-Transfer-Encoding: base64\r\n";
            $h .= "Content-Disposition: attachment; filename=\"".basename($fileatt)."\"\r\n\r\n";
            $h .= $content."\r\n\r\n";
            $h .= "--".$uid."--";

            // send mail
            return mail( $to, $subject, strip_tags($messagehtml), str_replace("\r\n","\n",$h) ) ;

        }

http://www.barattalo.it/2010/01/10/sending-emails-with-attachment-and-html-with-php/
JapanPro