E-mailing php code

[phily245]

Hi all,

 

I have a problem with emailing php code using a php function. using the code below, It emails the message 2 times with blank content. I think the problem might be with the eval() or file_get_content(), because if I comment it out the eval() and replace $message with a static value,  it sends the message once with the static content. The functions safeText (which does a mysql_real_escape_string), returnShopName (which returns the shop name) and returnShopEmailURL(which returns the url of the shop minus the http://www) all work, as they are used in other functions.

 

here is the function:

<?php
//Email a link to the voucher
function emailVoucher($id) {

//Ensure no one can use a combined URL and SQL Injection attack, as it comes from a $_GET
$id = safeText($id);

//Query the database, count the results and make an array to hold them
$query = mysql_query("SELECT * FROM shop_vouchers WHERE voucher_id = '".$id."' LIMIT 1") or die ('Error: '.mysql_error());
$count =  mysql_num_rows($query);
$fetch = mysql_fetch_array($query);

//If there are results
if($count == 1) {

		$to = $fetch["voucher_email"];
		$subject = 'Your voucher from '.returnShopName();
		$headers = 'From: website@'. returnShopEmailURL() . "\r\n" . 'Reply-To: no-reply@'. returnShopEmailURL() . "\r\n" . 'X-Mailer: PHP/' . phpversion() . 'MIME-Version: 1.0' . "\r\n" . 'Content-type: text/html' . "\r\n";

		$link = 'http://www.example.com/vouchers.php?email=1';
		$name = returnShopName();
		$URL = returnShopEmailURL();

		$body = file_get_contents('includes/voucher_email.php');

		eval("\$body = \"$message\";");

		mail($to, $subject, $message, $headers);

		gotoURL("vouchers.php?issue=1");

}else{

	//Popup error message and redirect
	echo '<script type="text/javascript">';
	echo 'alert("An error occurred. Please try again.")';
	echo '</script>';
	gotoURL("vouchers.php");

}
}
?>

 

the code in voucher_email.php (for testing purposes) is:

$name 1, $link 2, $URL 3

[AyKay47]

1. avoid eval(), its evil.

2. you are setting $body to $message, which isn't defined..

 

eval("\$message = \"$body\";");