email script issue

[TomFromKWD]

Guys Im having a strange issue with my code

 

I have a form to request a password to be sent to email incase forgotten

 

The script seems to run as it should as in taking the info then redirecting to the messages page for confirmation no problem

but its not sending the email

 

Ive checked and double checked, and even re written the code from scratch and nothing seems to be playing ball in sending the email

 

Can someone shed some none sleep deprived eyes over it and point out what will no doubt be an obvious error I just cant seem to see 

 

The Form:

<form name="sendpw" method="post" action="sendpw.php">
   <br>
<table width="100%" border="0" class="tbl">
  <tr>
    <td width="198"><div align="right">Username:</div></td>
    <td width="418"><input name="name" type="text" class="input" size="30"></td>
  </tr>
  <tr>
    <td><div align="right">Email: </div>      </td>
    <td><input name="mail" type="text" class="input" size="30"></td>
  </tr>
  <tr>
    <td colspan="2"> <div align="center">
      <input name="Submit" type="submit">      
    </div></td>
    </tr>
</table>

</form> 

 

 

The Script:

<?
include ('config.php');

$name=$_POST['name'];
$em=$_POST['mail'];

$query="SELECT pw FROM user WHERE uname='$name' AND email='$em'" or die (mysql_error());

$result= mysql_query($query);

$row = mysql_fetch_assoc($result);

$pass=$row['pw'];
$to="$em";
$from="From: passwords@MBD.net";
$msg="Username: $name\r\n";
$msg .="Password: $pass\r\n";
$msg .="Please keep this password safe";
$subject="Your Login Password\r\n";

mail($to,$subject,$msg,$from);
header( "Location:messages.php?msg=2" );
exit();
?>

 

config.php is just my database connection info, which is working fine as it runs all all my pages that access the database.

 

 

Thanks

 

Tom

[MrXHellboy]

Trying to send from localhost @ webserver?

[tomfmason]

You should sanitize all user input. For example:

 

<?php
$name=mysql_real_escape_string($_POST['name']);
$em=mysql_real_escape_string($_POST['mail']);
?>

 

I would also suggest that you read up on sql injection