PHP mail() --> Making a Form / Validating Input / Sending an email

c010depunkk · Oct 23rd, 2007, 07:06

Here's a short tutorial on creating a form mail application using PHP.

Please read through this before posting any questions on this topic on the forums.

c010depunkk · Oct 23rd, 2007, 07:23

We'll start by making a simple HTML page:

HTML: Select all

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en">

<head>

<meta http-equiv="content-type" content="text/html; charset=iso-8859-1" />

<title>form mail</title>

<style type="text/css" media="all">
* { margin:0;padding:0; }
body { font:600 12px/22px verdana;padding:50px; }
.box, textarea, .button { border:2px solid #6699CC;font:inherit;color:inherit; }
.box { width:250px; }
textarea { width:300px;height:250px; }
.error { color:#DD1100; }
</style>

</head>

<body>

<div class="contact">
    <h1>Contact Us</h1>
    <p>Please fill out the form to contact us. Required fields are marked with a star [*].</p>
    <form name="contact" action="form_mail.php" method="post">
        <p>Name:* <input class="box" type="text" name="name" /></p>
        <p>E-Mail:* <input class="box" type="text" name="email" /></p>
        <p>Subject: <input class="box" type="text" name="subject" /></p>
        <p>Message:*</p><textarea name="message"></textarea>
        <p><input class="button" type="submit" action="submit" value="Send" />
    </form>
</div>

</body>

</html>

Save this code as "form_mail.php."

c010depunkk · Oct 23rd, 2007, 08:20

Now we'll continue by adding some user input validation. At the very top of form_mail.php add some PHP tags (<?php ?>) and then we can start coding.
The first thing we want to do is declare and initialize some variables that we will be using later in our script. The $required_fields array can be adjusted (for example, you could remove the 'email' field if you don't think it's necessary to know the email of the person contacting you). The $to_address variable should be changed to the email to which you want the contact requests to be sent to.

PHP: Select all


// declare and initialize some variables
$name=$email=$subject=$message=$error_message='';
$invalid_fields=array();
$required_fields=array('name','email','message');
$validated=array();
$to_address='blub@bla.com'; // your email address goes here

The next chunk of code checks if anything was posted and validates the user input:

PHP: Select all


// validate $_POST array
if(count($_POST)>0) { // was something posted?
    foreach($_POST as $key=>$value) { // loop through the $_POST array
        if(in_array($key,$required_fields)&&$value=='') { // check if a required field is empty
             // add that field to the $invalid_fields array
            array_push($invalid_fields,$key);
            // and append the error message to the $error_message variable
            $error_message.='<p>Please enter a'.(preg_match('/^[aeiouy]/',$key)?'n':'').' '.$key.'.</p>';
        }
        // field is not in the $invalid_fields array?
        if(!in_array($key,$invalid_fields)) {
            // copy it to the $validated array
            $validated[$key]=htmlspecialchars($value);
        }
    }
} else { // make everything invalid so that the form is outputted and not the thankyou message
    $invalid_fields=$required_fields;
}

Some explanations:

PHP: Select all


foreach($_POST as $key=>$value) { // loop through the $_POST array

This line lets us look at each index of the $_POST array. During each iteration, the value of the current index is stored in $value and the name of the current index is stored in $key. For example, when Justin Timberlake wants to contact you and submits the form, the first value in the $_POST array would be $_POST['name'] == 'Justin Timberlake' so during the first iteration of the FOREACH loop, $key == 'name' and $value == 'Justin Timberlake.'

PHP: Select all


if(in_array($key,$required_fields)&&$value=='') { // check if a required field is empty

In this IF statement we check if the current value of $key is in the $required_fields array. If it is then we check if it is empty ($value == '') because a required field MUST contain a value.

PHP: Select all


(preg_match('/^[aeiouy]/',$key)?'n':'')

This little inline IF isn't really necessary, it just raises the Usability. The regular expression checks to see if the value stored in $key starts with a vowel and if it does, "a" becomes "an" (ex: "a name" or "an email").

PHP: Select all


$invalid_fields=$required_fields;

If nothing was posted, we set the $invalid_fields equal to the $required_fields. I'll explain why in my next post....

c010depunkk · Oct 23rd, 2007, 09:16

We now need to add some inline PHP to the HTML code:

HTML: Select all

<div class="contact">
    <h1>Contact Us</h1>
<?php
if(count($invalid_fields)<=0) { // send message / thank user
    // mail will get sent here
?>
    <p>Your message was successfully delivered.</p>
<?php } else { ?>
    <p>Please fill out the form to contact us. Required fields are marked with a star [*].</p>
    <?php echo(($error_message!=''?'<div class="error">'.$error_message.'</div>':'')); ?>
    <form name="contact" action="form_mail.php" method="post">
        <p>Name:* <input class="box" type="text" name="name" value="<?php echo($validated['name']); ?>" /></p>
        <p>E-Mail:* <input class="box" type="text" name="email" value="<?php echo($validated['email']); ?>" /></p>
        <p>Subject: <input class="box" type="text" name="subject" value="<?php echo($validated['subject']); ?>" /></p>
        <p>Message:*</p><textarea name="message"><?php echo($validated['message']); ?></textarea>
        <p><input class="button" type="submit" action="submit" value="Send" />
    </form>
<?php } ?>
</div>

Explanations:

PHP: Select all


if(count($invalid_fields)<=0) { // send message / thank user

Here we check if there are any invalid fields. If not, then we can send the email (still coming) and thank the user. Otherwise, we re-output the form. The valid values are outputted to the form, but the invalid entries are not.

PHP: Select all


<?php echo(($error_message!=''?'<div class="error">'.$error_message.'</div>':'')); ?>

Here we use an inline IF statement to check if the $error_message message variable contains something and if it does, then we output the error message to the user.

Some More Input Validation
Until now we have only checked to see if the required fields contained a value. You can get pretty paranoid about validating user input, but in this tutorial, we are just going to check if the email address has the correct format. To do this we need to modify the FOREACH loop:

PHP: Select all


foreach($_POST as $key=>$value) { // loop through the $_POST array
    if(in_array($key,$required_fields)&&$value=='') { // check if a required field is empty
         // add that field to the $invalid_fields array
        array_push($invalid_fields,$key);
        // and append the error message to the $error_message variable
        $error_message.='<p>Please enter a'.(preg_match('/^[aeiouy]/',$key)?'n':'').' '.$key.'.</p>';
    } else {
        switch($key) {
            case 'email': // validate email address format
                if(!preg_match('/^([A-Z0-9._%-]+)@([A-Z0-9.-]+)\.([A-Z]{2,6})$/i',$value);) {
                    array_push($invalid_fields,'email');
                    $error_message.='<p>Please enter a valid email.</p>';
                }
                break;
        }
    }
    // field is not in the $invalid_fields array?
    if(!in_array($key,$invalid_fields)) {
        // copy it to the $validated array
        $validated[$key]=htmlspecialchars($value);
    }
}

Explanations:
We added an ELSE statement and a SWITCH so that for each index of the $_POST array, we can perform further validation. Here we are only going to validate the 'email' value, but you can perform further validations by adding CASES to the SWITCH.

PHP: Select all


if(!preg_match('/^([A-Z0-9._%-]+)@([A-Z0-9.-]+)\.([A-Z]{2,6})$/i',$value);) {

There are hundreds of regular expressions that can be used to validate an email format. This is one of the simplest and most effective ones I've come across (from http://www.regularexpressions.info). If the entered email doesn't match this regex, then we add 'email' to the $invalid_fields array and append an error message.

Sending the EMail
So, now we've validated the user input and once the user has entered all the necessary information correctly, we can send the email:

PHP: Select all


<?php
if(count($invalid_fields)<=0) { // send message / thank user
    $formatted_message='When: '.date('r').'
Who: '.$name.' ('.$email.')
With What: '.$_SERVER['HTTP_USER_AGENT'].'
Message: '.$message;
    mail($to_address,$subject,$formatted_message);
?>

Explanations:
First we format the message a bit...: When --> get the date and time that the message was sent. Who --> the name and email supplied by the user. With What --> which browser the user used to contact us (I always find this interesting

). Message --> and the user's message.

PHP: Select all


mail($to_address,$subject,$formatted_message);

Configuring your server so that the mail() function works is too complicated to explain here. I'm just going to assume that it works.... The required parameters are $to_address (where the email is headed), $subject (the subject of the email) and $formatted_message (the body of the email).

FINISHED!
Good Luck with your project!
Feel free to post any questions....

EDIT: see post below for complete code.

c010depunkk · Jan 17th, 2008, 06:35

OK, for some reason, when you copy the code from the post, PHP throws errors at the IF statement on line 12....
No clue what that is all about.

I've attached a PHP file with the complete code. I've tested this file and it works!