Sending Mail Through PHP

Html-php

[omoutop]

Hi to all!
I need ur wisdom for one more time...
It is pretty strightforward to create an html form which posts all variables to a php script in order to sent an e-mail...the php Script requests the posted variables
$name=$HTTP_POST_VARS['name'];
etc... and use the PHP's mail function afterwards to send the email to the reciepient..
HOWEVER....what if someone has a WUSIWUG Editor which lets users create their own forms which have UNPREDICTABLE post Variables (might be fullname or name and surname etc..)
is there any way I can grab unpredictable variables from my PHP script once the form is submitted? ..in order to send the e-mail....
PLZ HELP ME
thx in advance

[omoutop]

<?php

// Simple Form Script
// Copyright (C) 2005 Eric Zhang
// This program is free software; you can redistribute it and/or
// modify it under the terms of the GNU General Public License
// as published by the Free Software Foundation; either version 2
// of the License, or (at your option) any later version.
//

//--------------------------Set these paramaters--------------------------

$subject = 'Form Submission'; // Subject of email sent to you.
$emailadd = '[e-mail]';// Your email address. This is where the form information will be sent.
$url = ''; // Where to redirect after form is processed.
$req = '0'; // Makes all fields required. If set to '1' no field can not be empty. If set to '0' any or all fields can be empty.

// --------------------------Do not edit below this line--------------------------
$text = "Results from form:\n\n";
$space = ' ';
$line = '
';
foreach ($_POST as $key => $value)
{
if ($req == '1')
{
if ($value == '')
{echo "$key is empty";die;}
}
$j = strlen($key);
if ($j >= 20)
{echo "Name of form element $key cannot be longer than 20 characters";die;}
$j = 20 - $j;
for ($i = 1; $i <= $j; $i++)
{$space .= ' ';}
$value = str_replace('\n', "$line", $value);
$conc = "{$key}:$space{$value}$line";
$text .= $conc;
$space = ' ';
}
mail($emailadd, $subject, $text, 'From: '.$emailadd.'');
echo '<META HTTP-EQUIV=Refresh CONTENT="0; URL='.$url.'">';
?>

[edited by: jatar_k at 4:57 pm (utc) on Aug. 3, 2005]
[edit reason] removed email address [/edit]

[jatar_k]

>> is there any way I can grab unpredictable variables from my PHP script once the form is submitted?

this goes down a path that leads to exploited mail forms and spqm probs or even better XSS and injection.

The whole point to making mailers secure is to only deal with expected variables and to test those expected variables for the expected format.

programming for all eventualities is a good way to get exploited.

[omoutop]

Very true Jatar_k but in my situation I cant to anything...I have a system where users have editors (WUSIWUG) in order to create pages and stuff as well as form..there is no way I can predict the form elements so the code above gives me them the opportunity to create such forms and send them though e-mail....it is the best I can do...I wouldnt leave it like this if I knew that the elements would be predictable or even same all the time...and I know this is not totaly secure...not all on my company are programmers but they do want the job done...u know what I mean
Thx for the suggestions!

[jatar_k]

well, if that is the case then you just foreach the POST array as you have done and hope it all works out.

Though what about writing a document about naming conventions for form fields and helping your users understand what needs doing for the mailer to work?

[omoutop]

Yeap,
that would be very helpfull for me as well as users
thx again!