PHP & HTML Form data handling

[OzWaz]

I am learning how to use PHP to handle input in a Contact Form on my website.

Using PHP I can send the form data to my email client. However I cannot achieve the outcome of sending a copy to the email address of the submitter.

I have searched the Internet particularly Stack Overflow and have found code that I am told will achieve this outcome

Here is the code:

<?php

if(isset($_POST['submit'])){

    $to = "email@example.com"; // this is your Email address

    $from = $_POST['email']; // this is the sender's Email address

    $first_name = $_POST['first_name'];

    $last_name = $_POST['last_name'];

    $subject = "Form submission";

    $subject2 = "Copy of your form submission";

    $message = $first_name . " " . $last_name . " wrote the following:" . "\n\n" . $_POST['message'];

    $message2 = "Here is a copy of your message " . $first_name . "\n\n" . $_POST['message'];


    $headers = "From:" . $from;

    $headers2 = "From:" . $to;

    mail($to,$subject,$message,$headers);

    mail($from,$subject2,$message2,$headers2); // sends a copy of the message to the sender

   // echo "Mail Sent. Thank you " . $first_name . ", we will contact you shortly."; OR

    // You can also use header('Location: thank_you.php'); to redirect to another page.

    }

?>

Adjusting it for my own circumstances and settings it will still send the information in the form to me but will not send the information to the submitter's email address.

What is particularly confusing is, if I modify the code by taking out this line of code

mail($to,$subject,$message,$headers);

Which includes my email address ($to), it still works and the information including ($subject) is still sent to my email address.

I would appreciate any assistance that anyone would offer

[NotionCommotion]

A couple suggestions:

Display errors

ini_set('display_errors', 1);

Do a reality check:

echo("$from,$subject2,$message2,$headers2");    //Added
mail($from,$subject2,$message2,$headers2);

I wouldn't expect that spaces need to be in the header, but regardless arrays seem more fullproof.

$headers2 = array(
    'From' => $to,
);

Read https://www.php.net/manual/en/function.mail.php again.

[benanamen]

Your code is vulnerable to an Email Header Injection Attack. Never ever trust user input. The FROM should be YOUR server, not the person filling out the form.