Formmail returns won't redirect

When form is submitted it won't redirect correctly since server upgrade

[Auris]

Since my host's server has had a disc upgrade as well as a php upgarde from v4.4.1 to v4.4.2 none of my forms, that use Jacks formmail php script, get redirected correctly (after they are submitted) to a confirmation page as well as being sent with blank subjects & from e-mail addresses.

The html coding hasn't changed at all, ie.
<form method="POST" action="http://www.domain.net/formmail.php" >
<input type=hidden name="redirect" value="http://www.domain.net/confirm.php">
<input type=hidden name="sort" value="order:Name,email">
<input type=hidden name="required" value="Name,email">
<input type=hidden name="subject" value="Subscribe!">
etc...

The script (like the html) has been unchanged since it was originally installed on the 'old' server when it all worked as it should but now the form does get sent but on submission, redirects to Jack's default page/info & sends without subject etc..

Can this be happening because the php version has changed & what can I do to make it work as it used to?

Thanks in advance for your help with this...

[mikesmith76]

shot in the dark - maybe register globals is turned off in the new configuration and the script relies on it being turned on? Never used the script in question so don't know whether this is the issue but it is a place to start.

[omoutop]

in case of register globals, a quick way to determine if thats the case is this...

in a file that is being used by all pages (some include file, for example dbcon.php, write the following...

extract(array_merge($_POST,$_GET,$_REQUEST));

If your pages now work, then the problem is the reg.globals.

[henry0]

A note of caution:
If reg globs are off; then do not try the easy route consisting in "tricking" your scripts to work.

Security wise you are way better of keeping it off
instead adapt your scripts to work with register globals off.

[Auris]

Thanks for the advice & suggestions, everyone.

I tried putting that line of code into a php file but to no avail - therefore I assume reg globals is on?

The formmail script still works with the suggested line of code but still not as it was supposed to.

Below is the actual code for the formmail script - if anyone has the time to take a look at it, would it be possible to recode it get the 're-direct', 'from e-mail' & 'subject line' to be parsed correctly?

Also the required fields on the form aren't enforced either.

<?
// for ultimate security, use this instead of using the form
$recipient = "[e-mail]"; // [e-mail]

// bcc emails (separate multiples with commas (,))
$bcc = "";

// referers.. domains/ips that you will allow forms to
// reside on.
$referers = array ('domain.com');

// banned emails, these will be email addresses of people
// who are blocked from using the script (requested)
$banlist = array ('*@somedomain.com', '[e-mail]', '[e-mail]');

// field / value seperator
define("SEPARATOR", ($separator)?$separator:": ");

// content newline
define("NEWLINE", ($newline)?$newline:"\n");

// formmail version (for debugging mostly)
define("VERSION", "5.0");

// our mighty error function..
function print_error($reason,$type = 0) {
build_body($title, $bgcolor, $text_color, $link_color, $vlink_color, $alink_color, $style_sheet);
// for missing required data
if ($type == "missing") {
if ($missing_field_redirect) {
header("Location: $missing_field_redirect?error=$reason");
exit;
} else {
?>
The form was not submitted for the following reasons:<p>
<ul><?
echo $reason."\n";
?></ul>
Please use your browser's back button to return to the form and try again.<?
}
} else { // every other error
?>
The form was not submitted because of the following reasons:<p>
<?
}
echo "<br><br>\n";
exit;
}

// function to check the banlist
// suggested by a whole lot of people.. Thanks
function check_banlist($banlist, $email) {
if (count($banlist)) {
$allow = true;
foreach($banlist as $banned) {
$temp = explode("@", $banned);
if ($temp[0] == "*") {
$temp2 = explode("@", $email);
if (trim(strtolower($temp2)) == trim(strtolower($temp[1])))
$allow = false;
} else {
if (trim(strtolower($email)) == trim(strtolower($banned)))
$allow = false;
}
}
}
if (!$allow) {
print_error("You are using from a <b>banned email address.</b>");
}
}

// function to check the referer for security reasons.
// contributed by some one who's name got lost.. Thanks
// goes out to him any way.
function check_referer($referers) {
if (count($referers)) {
$found = false;

$temp = explode("/",getenv("HTTP_REFERER"));
$referer = $temp[2];

if ($referer=="") {$referer = $_SERVER['HTTP_REFERER'];
list($remove,$stuff)=split('//',$referer,2);
list($home,$stuff)=split('/',$stuff,2);
$referer = $home;
}

for ($x=0; $x < count($referers); $x++) {
if (eregi ($referers[$x], $referer)) {
$found = true;
}
}
if ($referer =="")
$found = false;
if (!$found){
print_error("You are coming from an <b>unauthorized domain.</b>");
error_log("[FormMail.php] Illegal Referer. (".getenv("HTTP_REFERER").")", 0);
}
return $found;
} else {
return true; // not a good idea, if empty, it will allow it.
}
}
if ($referers)
check_referer($referers);

if ($banlist)
check_banlist($banlist, $email);

// This function takes the sorts, excludes certain keys and
// makes a pretty content string.
function parse_form($array, $sort = "") {
// build reserved keyword array
$reserved_keys[] = "MAX_FILE_SIZE";
$reserved_keys[] = "required";
$reserved_keys[] = "redirect";
$reserved_keys[] = "require";
$reserved_keys[] = "path_to_file";
$reserved_keys[] = "recipient";
$reserved_keys[] = "subject";
$reserved_keys[] = "sort";
$reserved_keys[] = "style_sheet";
$reserved_keys[] = "bgcolor";
$reserved_keys[] = "text_color";
$reserved_keys[] = "link_color";
$reserved_keys[] = "vlink_color";
$reserved_keys[] = "alink_color";
$reserved_keys[] = "title";
$reserved_keys[] = "missing_fields_redirect";
$reserved_keys[] = "env_report";
$reserved_keys[] = "submit";
if (count($array)) {
if (is_array($sort)) {
foreach ($sort as $field) {
$reserved_violation = 0;
for ($ri=0; $ri<count($reserved_keys); $ri++)
if ($array[$field] == $reserved_keys[$ri]) $reserved_violation = 1;

if ($reserved_violation!= 1) {
if (is_array($array[$field])) {
for ($z=0;$z<count($array[$field]);$z++)
$content .= $field.SEPARATOR.$array[$field][$z].NEWLINE;
} else
$content .= $field.SEPARATOR.$array[$field].NEWLINE;
}
}
}
while (list($key, $val) = each($array)) {
$reserved_violation = 0;
for ($ri=0; $ri<count($reserved_keys); $ri++)
if ($key == $reserved_keys[$ri]) $reserved_violation = 1;

for ($ri=0; $ri<count($sort); $ri++)
if ($key == $sort[$ri]) $reserved_violation = 1;

// prepare content
if ($reserved_violation!= 1) {
if (is_array($val)) {
for ($z=0;$z<count($val);$z++)
$content .= $key.SEPARATOR.$val[$z].NEWLINE;
} else
$content .= $key.SEPARATOR.$val.NEWLINE;
}
}
}
return $content;
}

// mail the content we figure out in the following steps
function mail_it($content, $subject, $email, $recipient) {
global $attachment_chunk, $attachment_name, $attachment_type, $attachment_sent, $bcc;

$ob = "----=_OuterBoundary_000";
$ib = "----=_InnerBoundery_001";

$headers = "MIME-Version: 1.0\r\n";
$headers .= "From: ".$email."\n";
$headers .= "To: ".$recipient."\n";
$headers .= "Reply-To: ".$email."\n";
if ($bcc) $headers .= "Bcc: ".$bcc."\n";
$headers .= "X-Priority: 1\n";
$headers .= "X-Mailer: DT Formmail".VERSION."\n";
$headers .= "Content-Type: multipart/mixed;\n\tboundary=\"".$ob."\"\n";


$message = "This is a multi-part message in MIME format.\n";
$message .= "\n--".$ob."\n";
$message .= "Content-Type: multipart/alternative;\n\tboundary=\"".$ib."\"\n\n";
$message .= "\n--".$ib."\n";
$message .= "Content-Type: text/plain;\n\tcharset=\"iso-8859-1\"\n";
$message .= "Content-Transfer-Encoding: quoted-printable\n\n";
$message .= $content."\n\n";
$message .= "\n--".$ib."--\n";
if ($attachment_name &&!$attachment_sent) {
$message .= "\n--".$ob."\n";
$message .= "Content-Type: $attachment_type;\n\tname=\"".$attachment_name."\"\n";
$message .= "Content-Transfer-Encoding: base64\n";
$message .= "Content-Disposition: attachment;\n\tfilename=\"".$attachment_name."\"\n\n";
$message .= $attachment_chunk;
$message .= "\n\n";
$attachment_sent = 1;
}
$message .= "\n--".$ob."--\n";

mail($recipient, $subject, $message, $headers);
}

// take in the body building arguments and build the body tag for page display
function build_body($title, $bgcolor, $text_color, $link_color, $vlink_color, $alink_color, $style_sheet) {
if ($style_sheet)
echo "<LINK rel=STYLESHEET href=\"$style_sheet\" Type=\"text/css\">\n";
if ($title)
echo "<title>$title</title>\n";
if (!$bgcolor)
$bgcolor = "#FFFFFF";
if (!$text_color)
$text_color = "#000000";
if (!$link_color)
$link_color = "#0000FF";
if (!$vlink_color)
$vlink_color = "#FF0000";
if (!$alink_color)
$alink_color = "#000088";
if ($background)
$background = "background=\"$background\"";
echo "<body bgcolor=\"$bgcolor\" text=\"$text_color\" link=\"$link_color\" vlink=\"$vlink_color\" alink=\"$alink_color\" $background>\n\n";
}

// check for a recipient email address and check the validity of it
// Thanks to Bradley miller ([e-mail]) for pointing
// out the need for multiple recipient checking and providing the code.
$recipient_in = split(',',$recipient);
for ($i=0;$i<count($recipient_in);$i++) {
$recipient_to_test = trim($recipient_in[$i]);
if (!eregi("^[_\\.0-9a-z-]+@([0-9a-z][0-9a-z-]+\\.)+[a-z]{2,6}$", $recipient_to_test)) {
print_error("<b>I NEED VALID RECIPIENT EMAIL ADDRESS ($recipient_to_test) TO CONTINUE</b>");
}
}

// This is because I originally had it require but too many people
// were used to Matt's Formmail.pl which used required instead.
if ($required)
$require = $required;
// handle the required fields
if ($require) {
// seperate at the commas
$require = ereg_replace( " +", "", $require);
$required = split(",",$require);
for ($i=0;$i<count($required);$i++) {
$string = trim($required[$i]);
// check if they exsist
if((!(${$string})) ¦¦ (!(${$string}))) {
// if the missing_fields_redirect option is on: redirect them
if ($missing_fields_redirect) {
header ("Location: $missing_fields_redirect");
exit;
}
$require;
$missing_field_list .= "<b>Missing: $required[$i]</b><br>\n";
}
}
// send error to our mighty error function
if ($missing_field_list)
print_error($missing_field_list,"missing");
}

// check the email fields for validity
if (($email) ¦¦ ($EMAIL)) {
$email = trim($email);
if ($EMAIL) $email = trim($EMAIL);
if (!eregi("^[_\.0-9a-z-]+@([0-9a-z][0-9a-z-]+\.)+[a-z]{2,6}$", $email))
print_error("your <b>email address</b> is invalid");
$EMAIL = $email;
}

// check zipcodes for validity
if (($ZIP_CODE) ¦¦ ($zip_code)) {
$zip_code = trim($zip_code);
if ($ZIP_CODE) $zip_code = trim($ZIP_CODE);
if (!ereg("(^[0-9]{5})-([0-9]{4}$)", trim($zip_code)) && (!ereg("^[a-zA-Z][0-9][a-zA-Z][[:space:]][0-9][a-zA-Z][0-9]$", trim($zip_code))) && (!ereg("(^[0-9]{5})", trim($zip_code))))
print_error("your <b>zip/postal code</b> is invalid");
}

// check phone for validity
if (($PHONE_NO) ¦¦ ($phone_no)) {
$phone_no = trim($phone_no);
if ($PHONE_NO) $phone_no = trim($PHONE_NO);
if (!ereg("(^(.*)[0-9]{3})(.*)([0-9]{3})(.*)([0-9]{4}$)", $phone_no))
print_error("your <b>phone number</b> is invalid");
}

// check phone for validity
if (($FAX_NO) ¦¦ ($fax_no)) {
$fax_no = trim($fax_no);
if ($FAX_NO) $fax_no = trim($FAX_NO);
if (!ereg("(^(.*)[0-9]{3})(.*)([0-9]{3})(.*)([0-9]{4}$)", $fax_no))
print_error("your <b>fax number</b> is invalid");
}

// sort alphabetic or prepare an order
if ($sort == "alphabetic") {
uksort($HTTP_POST_VARS, "strnatcasecmp");
} elseif ((ereg('^order:.*,.*', $sort)) && ($list = explode(',', ereg_replace('^order:', '', $sort)))) {
$sort = $list;
}

// prepare the content
$content = parse_form($HTTP_POST_VARS, $sort);

// check for an attachment if there is a file upload it
if ($attachment_name) {
if ($attachment_size > 0) {
if (!$attachment_type) $attachment_type = "application/unknown";
$content .= "Attached File: ".$attachment_name."\n";
$fp = fopen($attachment, "r");
$attachment_chunk = fread($fp, filesize($attachment));
$attachment_chunk = base64_encode($attachment_chunk);
$attachment_chunk = chunk_split($attachment_chunk);
}
}

// check for a file if there is a file upload it
if ($file_name) {
if ($file_size > 0) {
if (!ereg("/$", $path_to_file))
$path_to_file = $path_to_file."/";
$location = $path_to_file.$file_name;
if (file_exists($path_to_file.$file_name))
$location = $path_to_file.rand(1000,3000).".".$file_name;
copy($file,$location);
unlink($file);
$content .= "Uploaded File: ".$location."\n";
}
}

// second file (see manual for instructions on how to add more.)
if ($file2_name) {
if ($file_size > 0) {
if (!ereg("/$", $path_to_file))
$path_to_file = $path_to_file."/";
$location = $path_to_file.$file2_name;
if (file_exists($path_to_file.$file2_name))
$location = $path_to_file.rand(1000,3000).".".$file2_name;
copy($file2,$location);
unlink($file2);
$content .= "Uploaded File: ".$location."\n";
}
}

// if the env_report option is on: get eviromental variables
if ($env_report) {
$env_report = ereg_replace( " +", "", $env_report);
$env_reports = split(",",$env_report);
$content .= "\n------ eviromental variables ------\n";
for ($i=0;$i<count($env_reports);$i++) {
$string = trim($env_reports[$i]);
if ($env_reports[$i] == "REMOTE_HOST")
$content .= "REMOTE HOST: ".$REMOTE_HOST."\n";
if ($env_reports[$i] == "REMOTE_USER")
$content .= "REMOTE USER: ". $REMOTE_USER."\n";
if ($env_reports[$i] == "REMOTE_ADDR")
$content .= "REMOTE ADDR: ". $REMOTE_ADDR."\n";
if ($env_reports[$i] == "HTTP_USER_AGENT")
$content .= "BROWSER: ". $HTTP_USER_AGENT."\n";
}
}

// send it off
mail_it(stripslashes($content), ($subject)?stripslashes($subject):"Form Submission", $email, $recipient);
if (file_exists($ar_file)) {
$fd = fopen($ar_file, "rb");
$ar_message = fread($fd, filesize($ar_file));
fclose($fd);
mail_it($ar_message, ($ar_subject)?stripslashes($ar_subject):"RE: Form Submission", ($ar_from)?$ar_from:$recipient, $email);
}

// if the redirect option is set: redirect them
if ($redirect) {
header("Location: $redirect");
exit;
} else {
echo "Thank you for your submission\n";
exit;
}

// <---------- THE END ----------> //
?>

Thanks again for your help with this...

[1][edited by: jatar_k at 6:43 pm (utc) on July 5, 2006]
[edit reason] removed urls [/edit]

[henry0]

It seems not to be PHP5 ready or at least ready to work with register_globals off

search and change any of the following

$HTTP_POST_VARS = $_POST;
$HTTP_GET_VARS = $_GET;
$HTTP_SERVER_VARS = $_SERVER;
$HTTP_COOKIE_VARS = $_COOKIE;
$HTTP_ENV_VARS = $_ENV;
$HTTP_POST_FILES = $_FILES;

the first value represents the old "way"
at first glnace I noticed
$HTTP_GET_VARS
change it to $_POST

[Auris]

Thx henry0 for your response,

I found 2 instances of $HTTP_POST_VARS (none of the others though) which I replaced with $_POST, but unfortunately the script behaves exactly the same way, ie no better, no worse.

Should $HTTP_USER_AGENT remain as it is?

Incidentally my hosting company can shed no light on this problem either...

[henry0]

From the manual
<<<
Predefined Variables
Since PHP 4.1.0, the preferred method for retrieving external variables is with the superglobals mentioned below. Before this time, people relied on either register_globals or the long predefined PHP arrays ($HTTP_*_VARS). As of PHP 5.0.0, the long PHP predefined variable arrays may be disabled with the register_long_arrays directive.

Server variables: $_SERVER
>>>

Hope it works

[Auris]

Thx for your help henry0 but I still can't get it to work properly.

I can't remember if I mentioned it but the data captured in the form is returned in the e-mail but without subject header & user isn't re-directed to the confirm page.

So if you have any more suggestions ....