Mail() only sending first word from subject

Question

When i send some email, it only sends the first word from the subject:

Example: I send an email with the name of "Send email", it only sends the word "Send", how can i prevent that?

Code:

The subject is selected in a select box

<td><a>
<?=  ' '.$val['email'].'  '; ?>
<input type="text" value="<?=  $val['email']; ?>" name="to"/>
</a></td>

<td>
<select name="subject">
<?php
  foreach($templatesarr as $val){
   echo '<option value='.$val['name'].'>'.$val['name'].'</option>';
  }
  echo '</select></td>
  <td><input type="submit" name="send" value="Send e-mail" /></td>
  </td></tr>
  ';
  ?>
  </form>

Check if the button was clicked

if(isset($_POST['send'])){
$sendername = 'Company';
$from = 'noreplay@compaty.com';
$to      = safe($_POST['to']);

$subject =  safe($_POST['subject']);
$message = 'teste';

$headers  = 'MIME-Version: 1.0' . PHP_EOL;
$headers .= 'Content-type: text/html; charset=iso-8859-1' . PHP_EOL;
$headers .= "From: $sendername <$from>".PHP_EOL;

mail($to, $subject, $message, $headers);

}else{
$to = NULL;

}

Safe function

function safe($value) {
    return mysql_real_escape_string($value);
}

Show the code for your `safe()` function. We can't do anything without seeing that. — John Conde, Jun 10 '14 at 13:06
`mysql_real_escape_string()` is almost certainly the wrong function to use. — Ja͢ck, Jun 10 '14 at 13:10
i already tried to remove the mysql real escape string, but even without this function, it only sends the first word from the subject — user3726150, Jun 10 '14 at 13:11
On a side-note you should read **[this](http://stackoverflow.com/q/4565066/1401094)** — Patsy Issa, Jun 10 '14 at 13:12
I know that mail() isn't the best way to send emails in PHP, and i should download a library, but i'm only using mail() to do a simulation for my final project. — user3726150, Jun 10 '14 at 13:14

score 1 · Accepted Answer · answered Jun 10 '14 at 13:13

1

The main problem is caused by not escaping variables and not properly encapsulating your attribute values; use this instead:

foreach($templatesarr as $val){
   printf('<option value="%1$s">%1$s</option>', 
       htmlspecialchars($val['name'], ENT_QUOTES, 'UTF-8')
   );
}

It now uses "" to delimit the value attribute of the option element.

answered Jun 10 '14 at 13:13

Ja͢ck

170,779
38
263
309

In case this was too cryptic, Jack says make sure your HTML uses `""` for the attributes. Thus making ` – nl-x Jun 10 '14 at 13:16
Jack, can you explain me what the %1$s does? – user3726150 Jun 10 '14 at 13:21
@user3726150 It's explained in [the manual](http://php.net/manual/en/function.sprintf.php#example-4965). – Ja͢ck Jun 10 '14 at 13:24

Mail() only sending first word from subject

1 Answers1