Is this a server problem or a code problem? [Archive]

kargrafx

11-16-2006, 06:24 AM

Okay, something seems to be wrong with this registration script.

I had a test version working perfectly, so I went live with it.

It still works fine for me - but 3 out of 4 who have tested the live version are not getting any emails; including a few who DID get emails from the test version. I tried at multiple email accounts I own, and all work (gmail, yahoo, personal servers). I have had reports of failure on some personal email servers, some yahoo accounts, and some msn accounts.

The main one complaining is the owner of the site, who was getting emails with the test version, and is now not getting emails with the live version.

The only differences between test and live are a few variable values, and the name of the file (index.php instead of test.php)...I have tried reverting them, with no luck.

Could I get some few of you to try to register (probably want to uncheck the 'Yes, keep me notified!' field) and let me know if you get the email? The site is www.greathomes.bz/inex.php - I hope this is not considered spamming; I'm not promoting the site, just looking for help with the code.

Here is the script...

<html><head><style type="text/css">

</style></head><body><div align="center"><a href="index.html"><img src="images/ghomeslogo.gif" width="568" height="92" border="0"></a><span style="font-size: 120%;"><br />A REAL ESTATE MARKETING SOURCE THAT TRULY WORKS.<br /><p />
<?php
if (isset($_POST['submitted'])) {

$name = $_POST['name'];
$email = $_POST['email'];
$phone = $_POST['phone'];
$optin = $_POST['optin'];
$body = "
Name: $name
Email: $email
Phone: $phone
Opt-In: $optin";

if (isset($optin)) {
$opt = "You have chosen to receive periodic email updates about our open houses and auctions.";
} else {
$opt = "You have chosen to not receive any email updates about our open houses and auctions.";
}

if (is_writable('user_data.csv')) {
$csv = '

Documented in user_data.csv';
$fp = fopen('user_data.csv','a');
$content = "$name,$email,$phone,$optin,\n";
fwrite($fp,$content);
fclose($fp);
} else {
$csv = '

File was not writable, not documented in user_data.csv.';
}

mail ($email, 'Password', 'The user name and password for www.greathomes.bz/index2.php is:

Username: GreatHomes
Password: Auctions

Please remember, they are case-sensitive.

'.$opt, 'From: greathomes.bz') &&
mail ('r2k@r2k-sold.com', 'new registration', $body . $csv, 'From: '.$name.'<'.$email.'>');

echo 'Thank you for registering for our website!
You should receive an email shortly with the username and password to log in.';
} else {
echo '
<p>Please take a moment to register with us.<br />
It is free, and absolutely no financial information is collected.<br />
One you have registered, you may access the website.</p>
<p>Registered users, please click <a href="http://www.greathomes.bz/index2.php">here</a> to log in. </p>
<br /><p />
<form method="post" action="index.php">
<table width="330" border="0" cellpadding="1" cellspacing="1" summary="Please enter your information to log into the website.">
<caption>
Registration Form
</caption>
<tr>
<td width="120"><span class="style3">Name:</td>
<td width="10"> </td>
<td width="200"><input type="text" size="30" name="name" /></td>
</tr>
<tr>
<td><span class="style3">Email: </td>
<td> </td>
<td><input type="text" size="30" name="email" /></td>
</tr>
<tr>
<td><span class="style3">Phone Number: </td>
<td> </td>
<td><input type="text" size="30" name="phone" /></td>
</tr>
<tr>
<td> </td>
<td> </td>
<td> </td>
</tr>
<tr>
<td colspan="3"><p align="center" class="style2">By selecting this box you are signing up for our email list.<br />
We use this to keep you updated on our open houses and auctions. </p></td>
</tr>
<tr>
<td><div align="center">
<input name="optin" type="checkbox" checked="checked" />
</div></td>
<td> </td>
<td><span class="style3">Yes, keep me notified!</span></td>
</tr>
<tr>
<td> </td>
<td> </td>
<td> </td>
</tr>
<tr>
<td> </td>
<td> </td>
<td><input type="submit" name="submitted" value="Sign Up!" /></td>
</tr>
</table>
<p>  </p>
</form> ';
}

?>
</div>
</body>
</html>

CFMaBiSmAd

11-16-2006, 07:16 AM

Was the test setup and the live setup on the same server and sending email through the same mail server?

I suspect that some of the problem is the from address - 'From: greathomes.bz' This is not a valid email address and a lot of sending mail servers, receiving mail servers, and spam filters are not going to accept an email with a from address like this.

Note: Now that you have posted the domain where this is located and that the code places the name and email from the form directly into the header field of the second mail(...) function without testing them, a lot of spammers are going to start sending their email through this site. You need to search for "php email header injection" to find out how to secure this code. Since the message body contains the name and email, I recommend changing the From: address to be the same as the To: address. This will result in an email to yourself from yourself but it eliminates the ability of a spammer to use the header field to send email with any content to anyone he wants.