0

I have a php contact form which works just fine with the excepetion that in the message section certain characters are either removed or replaced with a code equivalent.

ie. both < and > are removed entirely. if in that order

" is replaced with &#34;

' is replaced with &#39;

£ is replaced with £

So if a user enters the message....

apos here - ' less than here - < greater than here - > quote here - " pound here - £ then the received message reads...

apos here - &#39; less than here - quote here - &#34; pound here - £ - note the <> are removed completely (and the enclosed text).

How can I get the $message to send the correct text?

<?php
if($_POST)
{
    require_once "Mail.php";  //added to find PEAR root location
    
    $to_email       = "recipientemail@hotmail.com"; //Recipient email, Replace with own email here

 // smtp stuff added for PEAR mail
 $host = "ssl://myhost.com";
 $username = "myemail@mydomain.com";
 $password = "mypass";
 $port = 465;
 
 $smtp = Mail::factory('smtp',
   array ('host' => $host,
     'auth' => true,
     'port' => $port,
     'username' => $username,
     'password' => $password));
//end smtp stuff

    //check if its an ajax request, exit if not
    if(!isset($_SERVER['HTTP_X_REQUESTED_WITH']) AND strtolower($_SERVER['HTTP_X_REQUESTED_WITH']) != 'xmlhttprequest') {
        
        $output = json_encode(array( //create JSON data
            'type'=>'error', 
            'text' => 'Sorry Request must be Ajax POST'
        ));
        die($output); //exit script outputting json data
    } 
    
    //Sanitize input data using PHP filter_var().
    $user_name      = filter_var($_POST["user_name"], FILTER_SANITIZE_STRING);
    $user_email     = filter_var($_POST["user_email"], FILTER_SANITIZE_EMAIL);
    $subject        = filter_var($_POST["subject"], FILTER_SANITIZE_STRING);
    $message        = filter_var($_POST["msg"], FILTER_SANITIZE_STRING);
    
    //additional php validation
    if(strlen($user_name)<2){ // If length is less than 4 it will output JSON error.
        $output = json_encode(array('type'=>'error', 'text' => '<p>Name is too short or empty!</p>'));
        die($output);
    }
    if(!filter_var($user_email, FILTER_VALIDATE_EMAIL)){ //email validation
        $output = json_encode(array('type'=>'error', 'text' => '<p>Please enter a valid email!</p>'));
        die($output);
    }
    if(strlen($message)<3){ //check emtpy message
        $output = json_encode(array('type'=>'error', 'text' => '<p>Too short message! Please enter something.</p>'));
        die($output);
    }
    
    //email body
    $message_body = "\r\nMessage:\r\n".$message."\r\n\r\nName: ".$user_name."\r\nEmail: ".$user_email;
    
    //proceed with PHP email.
    $subject = 'Enquiry';
    $headers = 'From: myemail@mydomain.com' . "\r\n" .
    'Reply-To: '.$user_email.'' . "\r\n" .
    'Bcc: mysecondemail@hotmail.com' . "\r\n";
    
    $send_mail = mail($to_email, $subject, $message_body, $headers);
    
    if(!$send_mail)
    {
        //If mail couldn't be sent output error. Check your PHP email configuration (if it ever happens)
        $output = json_encode(array('type'=>'error', 'text' => '<p>Could not send mail! Please check your PHP mail configuration.</p>'));
        die($output);
    }else{
        // you can edit your success message below  
        $output = json_encode(array('type'=>'message', 'text' => '<div class="alert alert-success" role="alert">
        Hi '.$user_name .', Thank you for your message. We will contact you soon.</div>'));
        die($output);
    }
}
?>

I'm a real newbie and I'm sure it's something really basic I'm missing, but it's driving me nuts! Thanks in advance

Bud
  • 1
  • 2
    It's because you're running the message through filter_var's [FILTER_SANITIZE_STRING](https://www.php.net/manual/en/filter.filters.sanitize.php) filter. -- `Strip tags and HTML-encode double and single quotes, optionally strip or encode special characters. Encoding quotes can be disabled by setting FILTER_FLAG_NO_ENCODE_QUOTES.` – aynber Sep 10 '21 at 19:18
  • 3
    The wonky `£` is because your client is sending you UTF8 and whatever you're using to look at that data is not interpreting it as UTF8. https://stackoverflow.com/questions/279170/utf-8-all-the-way-through – Sammitch Sep 10 '21 at 19:22

0 Answers0