Stripping out apostrophes in php contact form

[thebluebus]

i'm having problems with apostrophes causing an error on my contact form. I've tried stripslash and also str_replace but i can't get it to work. what am i doing wrong?

 

thanks 

 

 

<?php
if(isset($_POST['email'])) {
     
    // EDIT THE 2 LINES BELOW AS REQUIRED
    $email_to = "test@test.com";
    $email_subject = "test";
     
     
    function died($error) {
        // your error code can go here
        echo "We are very sorry, but there were error(s) found with the form you submitted. ";
        echo "These errors appear below.<br /><br />";
        echo $error."<br /><br />";
        echo "Please go back and fix these errors.<br /><br />";
        die();
    }
     
    // validation expected data exists
    if(!isset($_POST['contact_name']) ||
        !isset($_POST['last_name']) ||
        !isset($_POST['email']) ||
        !isset($_POST['telephone']) ||
        !isset($_POST['comments'])) {
        died('We are sorry, but there appears to be a problem with the form you submitted.');      
    }
    
    foreach($_POST['check'] as $value) { 
$check_msg .= "Checked: $value\n"; 
	} 

    $contact_name = str_replace("'", "&#039;", $contact_name); 
    $contact_name = $_POST['contact_name']; // required
    $last_name = $_POST['last_name']; // required
    $email_from = $_POST['email']; // required
    $telephone = $_POST['telephone']; // not required
    $comments = $_POST['comments']; // required
     
    $error_message = "";
    $email_exp = '/^[A-Za-z0-9._%-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,4}$/';
  if(!preg_match($email_exp,$email_from)) {
    $error_message .= 'The Email Address you entered does not appear to be valid.<br />';
  }
    $string_exp = "/^[A-Za-z .'-]+$/";
    
  if(!preg_match($string_exp,$contact_name)) {
    $error_message .= 'The First Name you entered does not appear to be valid.<br />';
  }
  if(!preg_match($string_exp,$last_name)) {
    $error_message .= 'The Last Name you entered does not appear to be valid.<br />';
  }
  if(strlen($comments) < 2) {
    $error_message .= 'The Comments you entered do not appear to be valid.<br />';
  }
  if(strlen($error_message) > 0) {
    died($error_message);
  }
    $email_message = "Form details below.\n\n";
     
    function clean_string($string) {
      $bad = array("content-type","bcc:","to:","cc:","href");
      return str_replace($bad,"",$string);
    }
     
    $email_message .= "Contact Name: ".clean_string($contact_name)."\n";
    $email_message .= "Agency/Company Name: ".clean_string($last_name)."\n";
    $email_message .= "Email Address: ".clean_string($email_from)."\n";
    $email_message .= "Dates Required: ".clean_string($telephone)."\n";
    $email_message .= "Type Required: ".clean_string($check_msg)."\n";
    $email_message .= "Any other info: ".clean_string($comments)."\n";


     
     
// create email headers
$headers = 'From: '.$email_from."\r\n".
'Reply-To: '.$email_from."\r\n" .
'X-Mailer: PHP/' . phpversion();
@mail($email_to, $email_subject, $email_message, $headers); 
?>

thanks

<?php
}
?>

[xyph]

Could you isolate the error?

[thebluebus]

sorry, what do you mean?

 

its this bit i'm having trouble with

 

  $contact_name = str_replace("'", "'", $contact_name); 
    $contact_name = $_POST['contact_name']; // required
    $last_name = $_POST['last_name']; // required
    $email_from = $_POST['email']; // required
    $telephone = $_POST['telephone']; // not required
    $comments = $_POST['comments']; // required

[xyph]

Your error is pretty obvious.

 

Order is very important in procedural programming.

[thebluebus]

i guess its only obvious if you know the answer 

[xyph]

You're trying to str_replace a variable before it's being defined.

 

Or, you're defining it after you're str_replace'ing