PHP Email form - multiple recipients

[cyberdyne2]

I have a working email from in which I'd like to have the email sent to one of three different addresses depending on what subject is chosen:

 

<?php
$toEmail = '[email protected]';
$successPage = '';
function newLines($input)
{
if(strpos($input, "\n") === false && strpos($input, "\r") === false) { return false; }
return true;
}
function userData($input)
{
if (get_magic_quotes_gpc()) { $input = stripslashes($input); }
return $input;
}
function htmlSafe($input)
{
//Only for HTML output, to prevent XSS and accidental breakage.
return htmlspecialchars($input, ENT_COMPAT, 'UTF-8');
}
function links($input)
{
//To deny web links in any part of the email (or custom string).
if(strpos($input, "http") === false && strpos($input, "www") === false && strpos($input, ".cn") === false && strpos($input, "k0tibfj5c7ec") === false && strpos($input, ".kr") === false && strpos($input, ".jp") === false && strpos($input, ".ru") === false && strpos($input, ".com") === false && strpos($input, "url") === false && strpos($input, "htm") === false && strpos($input, "href") === false) { return false; }
return true;
}
$output = '';
$failure = false;
if(isset($_POST['senderName'])) //Check for submission.
//Each field should be set even if empty, and this is more reliable than checking a submit button,
//which isn't always sent if form was triggered by keyboard's "enter" key.
{
$senderName = userData($_POST['senderName']);
$senderEmail = userData($_POST['senderEmail']);
$subject = userData($_POST['subject']);
$hostname = gethostbyaddr($_SERVER['REMOTE_ADDR']);
$message = userData($_POST['message']);
$wholeBody = "\n*You have an email.*\n\n Subject: $subject \n\n Message:\n\n $message \n\nSent:\n On: " . strftime("%A,%d %B'%y\n At: %r")."\nBy:\n Name: $senderName\n Email address: $senderEmail\n IP: {$_SERVER['REMOTE_ADDR']} ($hostname)";
$headers = 'Bcc: [email protected]' . "\r\n";
if(strlen($senderName) == 0)
{
$failure = true;
$output .= '<p class="error">Please enter a name!</p>';
}
if(strlen($senderEmail) == 0)
{
$failure = true;
$output .= '<p class="error">Please enter an e-mail address!</p>';
}
elseif(!preg_match("/^[a-zA-Z0-9-_.]+\@[a-zA-Z0-9-.]{2,}\.[a-zA-Z]{2,4}$/u", $senderEmail))
{
$failure = true;
$output .= '<p class="error">Please enter a valid email or we cant reply!</p>';
}
if(strlen($subject) == 0)
{
$failure = true;
$output .= '<p class="error">Please enter a subject!</p>';
}
if(strlen($message) == 0)
{
$failure = true;
$output .= '<p class="error">Please enter a message!</p>';
}
if($failure == false && (newLines($senderName) || newLines($senderEmail) || newLines($subject)))
{
$failure = true;
$output .= '<p class="error">Sorry, there seem to be new lines in your message, which suggests you may be a spambot. '.
'If not, please remove line breaks from single line form fields.</p>';
}
//removed ---> || links($senderEmail)<--- from the following rule
if($failure == false && (links($senderName) || links($subject) || links($message)))
{
$failure = true;
$output .= '<p class="error">There appear to be advertising links in your message, which we do not permit. '.
'Your email has not been sent. Please remove the links and try again.</p>';
}
if($failure == false)
{
if(mail($toEmail, $subject, $wholeBody, "From: $senderName <$senderEmail>\r\nContent-Type: text/plain; charset=\"UTF-8\"\r\n$headers"))
{
if($successPage != '')
{
header('Location: '.$successPage);
}
$output .= '<p class="success">Thank you, your message has been sent.</p>';
}
else
{
$output .= '<p class="error">Sorry, there was an error sending your message. Feel free to try again.</p>';
}
}
}
else
{
$senderName = $senderEmail = $subject = $message = ''; //Prevent XSS via GET when register_globals is on
};
?>

 

Can anyone offer any help on how to achieve this please?

Thank you

[jonsjava]

Here's how I usually do it:

I make a drop-down with possible subjects. each has an integer value.  On the back side, I do something like this:

        $subject = userData($_POST['subject']);
switch ($subject){
	case 1:
		$subj = "hello";
		$sendmailto = "[email protected]";
		break;
	case 2:
		$subj = "need assistance";
		$sendmailto = "[email protected]";
		break;
	case 1:
		$subj = "I'm bored";
		$sendmailto = "[email protected]";
		break;
	case 1:
		$subj = "Cheeseburger in paradise";
		$sendmailto = "[email protected]";
		break;
	default:
		$should_i_send = false;

}

Now, how this works: it gets the integer for the subject. If the integer is in the list of cases, it sets the subject to a text value, and changes the sendmailto to a given user. If the subject isn't in the list of allowed integers, it drops them.

[cyberdyne2]

Many thanks for your reply.

 

While awaiting a reply I found another solution which works well (below). How do you think the two compare and can you see any advantages of your method over what I found?

 

Thanks again.

 

//-----------Script:--------------//

$recipients = array(
'Booking Enquiry' => '[email protected],[email protected]',
'General Enquiry' => '[email protected],[email protected]',
'Admissions' => '[email protected],[email protected]',
'Website Feedback' => '[email protected],[email protected]',
);
$toEmail = $recipients[$_REQUEST['subject']];
$successPage = '';

//-----------Form:--------------//


    echo '<select id="subject" name="subject" value="'.htmlSafe($subject).'">';
    echo '<option selected="selected" value=""> - Choose Subject -</option>';
    echo '<option value="Booking Enquiry">Booking Enquiry</option>';
    echo '<option value="General Enquiry">General Enquiry</option>';
    echo '<option value="Admissions">Admissions</option>';
    echo '<option value="Website Feedback">Website Feedback</option>';

[jonsjava]

could cause problems when the subject isn't in the array. My method has a catch-all.

[cyberdyne2]

could cause problems when the subject isn't in the array. My method has a catch-all.

 

I thought the subject could only be one of the four drop down options. Am I wrong?

Thanks

[jonsjava]

injections are easy. They can take your form, change the type of the fields, and enter whatever they like.

[cyberdyne2]

Ok, I thought my script prevented that, but then I've not posted the whole script.

injections are easy. They can take your form, change the type of the fields, and enter whatever they like.

 

Fair enough.

Should the case values read 1,2,1,1 ? Or should they be 1,2,3,4?

Thanks

[jonsjava]

lol. I copy pasted the cases, and forgot to renumber.

cases should be 1,2,3,4,...

[cyberdyne2]

lol. I copy pasted the cases, and forgot to renumber.

cases should be 1,2,3,4,...

 

Thought so

I've:

• changed the cases for 1,2,3,4
  
• changed the email addresses for real ones
  
• added my 4 x actual subjects
  
• changed $sendmailto to $toEmail to reflect what my script uses
  

 

Do I need to change $subj to $subject ?

 

It doesn't seem to work at the moment.

Thanks