PHP - Help Recieving A Post From External Client, And Then Sending Custom Response

<?php 
if(isset($_POST['sendmail'])) {
 
     
 
    // EDIT THE 2 LINES BELOW AS REQUIRED
 
    $email_to = "elie.w.daher@gmail.com";
 
    $email_subject = "Your email subject line";
 
     
 
     
 
    function died($error) {
 
        // your error code can go here
 
        echo "We are very sorry, but there were error(s) found with the form you submitted. ";
 
        echo "These errors appear below.<br /><br />";
 
        echo $error."<br /><br />";
 
        echo "Please go back and fix these errors.<br /><br />";
 
        die();
 
    }
 
     
 
    // validation expected data exists
 
    if(!isset($_POST['name']) ||
  
        !isset($_POST['email']) ||
 
        !isset($_POST['telephone']) ||
		
		!isset($_POST['location']) ||
 
 		!isset($_POST['date']) ||
		
		!isset($_POST['select']) ||
		
		!isset($_POST['color']) ||
		
		!isset($_POST['quantity']) ||
		
        !isset($_POST['comments'])) {
 
        died('We are sorry, but there appears to be a problem with the form you submitted.');       
 
    }
 
     
 
    $name = $_POST['name']; // required
      
    $email_from = $_POST['email']; // required
 
    $telephone = $_POST['telephone']; // not required
	
	$location = $_POST['location']; // not required
	
	$location = $_POST['date']; // not required
	
	$location = $_POST['select']; // not required
	
	$location = $_POST['color']; // not required
	
	$location = $_POST['quantity']; // not required
 
    $comments = $_POST['comments']; // required
 
     
 
    $error_message = "";
 
    $email_exp = '/^[A-Za-z0-9._%-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,4}$/';
 
  if(!preg_match($email_exp,$email_from)) {
 
    $error_message .= 'The Email Address you entered does not appear to be valid.<br />';
 
  }
 
    $string_exp = "/^[A-Za-z .'-]+$/";
 
  if(!preg_match($string_exp,$name)) {
 
    $error_message .= 'The First Name you entered does not appear to be valid.<br />';
 
  }
 
 
  if(strlen($comments) < 2) {
 
    $error_message .= 'The Comments you entered do not appear to be valid.<br />';
 
  }
 
  if(strlen($error_message) > 0) {
 
    died($error_message);
 
  }
 
    $email_message = "Form details below.\n\n";
 
     
 
    function clean_string($string) {
 
      $bad = array("content-type","bcc:","to:","cc:","href");
 
      return str_replace($bad,"",$string);
 
    }
 
     
 
    $email_message .= "First Name: ".clean_string($name)."\n";
 
    $email_message .= "Email: ".clean_string($email_from)."\n";
 
    $email_message .= "Telephone: ".clean_string($telephone)."\n";
	
	$email_message .= "Location: ".clean_string($location)."\n";
	
	$email_message .= "Event Date: ".clean_string($date)."\n";
	
	$email_message .= "Chair Style: ".clean_string($select)."\n";
	
	$email_message .= "Cushion color: ".clean_string($color)."\n";
	
	$email_message .= "Quantity: ".clean_string($quantity)."\n";
 
    $email_message .= "Comments: ".clean_string($comments)."\n";
 
     
 
     
 
// create email headers
 
$headers = 'From: '.$email_from."\r\n";
 
'Reply-To: '.$email_from."\r\n" ;
 
'X-Mailer: PHP/' . phpversion();
 
@mail($email_to, $email_subject, $email_message, $headers);  
 
?>
 
 
 
<!-- include your own success html here -->
 
 
 
Thank you for contacting us. We will be in touch with you very soon.
 
 
 
<?php
 
}
 
?>
 

A HTTP request is made to the server, Slim creates a Request and Response object, content in the Request is sent to another server using cURL via Guzzle, Guzzle returns its own Response,  and content from Guzzle's response must be returned by the original Slim response.

Would you recommend white-listing or black-listing response headers, and which specific headers?

Similarly, would you recommend white-listing or black-listing the request headers sent via cURL, and which specific headers?

Thanks

<?php
use Psr\Http\Message\ResponseInterface as Response;
use GuzzleHttp\Psr7\Response as CurlResponse;

class ApiResponder
{
    public function delete(Response $httpResponse, CurlResponse $curlResponse) {
        return $this->proxy($httpResponse, $curlResponse);
    }
    //other public methods...

    private function proxy(Response $httpResponse, CurlResponse $curlResponse) {
        foreach($this->getResponseHeaders($curlResponse) as $name=>$value) {
            $httpResponse=$httpResponse->withHeader($name, $value);
        }
        return $httpResponse->withBody($curlResponse->getBody())->withStatus($curlResponse->getStatusCode());
    }

    private function getResponseHeaders(Response $httpResponse):array
    {
        //Blacklist headers which should be returned to original client.  TBD whether I should whitelist headers instead.
        $blacklist=['Date'=>null, 'Server'=>null, 'X-Powered-By'=>null, 'Access-Control-Allow-Origin'=>null, 'Access-Control-Allow-Methods'=>null, 'Access-Control-Allow-Headers'=>null, 'Set-Cookie'=>null];
        return array_diff_key($curlResponse->getHeaders(), $blacklist);
    }

    /**
    * This method doesn't really exist in this class, but is just included to show which headers I am forwarding in the cURL request.
    */
    private function getRequestHeaders($clientRequest):array
    {
        $whitelist=['connection'=>null,'accept'=>null,'accept-encoding'=>null,'accept-language'=>null,'content-type'=>null,'content-length'=>null];
        return array_intersect_key($clientRequest->getHeaders(), $whitelist);
    }
}

stdClass Object
(
    [rules] => stdClass Object
        (
            [email] => stdClass Object
                (
                    [required] => 1
                    [email] => 1
                    [remote] => stdClass Object
                        (
                            [url] => check-email.php
                            [type] => post
                            [data] => stdClass Object
                                (
                                    [username] => function() {return $( '#username' ).val();}
                                )
                        )
                )
        )

    [messages] => stdClass Object
        (
            [email] => stdClass Object
                (
                    [required] => an email is required
                )
        )
)

exit('var myObj='.json_encode($myObj));

I'm sure it's not much, but I'm not understanding something with custom error handlers:

I've created a custom error handler, which I initially set when my page loads :

set_error_handler(array ( new ErrorHandler(), 'handleError' ));

It seems to catch all internal PHP errors, such as if I: var_dump($non_existing_var); right after the set_error_handler....

Now, I have an object that throws an exception after:

set_error_handler(array ( new ErrorHandler(), 'handleError' )); 
$locale = new \CorbeauPerdu\i18n\Locale(...); // this should throw an exception 
...

I thought that with an error handler set, I could 'skip' the try/catch for it, but doing so, PHP spits out in its internal log:

PHP Fatal error: Uncaught CorbeauPerdu\i18n\LocaleException: ....

My error handler doesn't catch it at all before, thus my page breaks!!

If I want it to go through the error handler, I have to init my Locale with a try/catch and use trigger_error() like so:

set_error_handler(array ( new ErrorHandler(), 'handleError' ));

try { 
  $locale = new \CorbeauPerdu\i18n\Locale(...); // this should throw an exception 
}
catch(Exception $e) { 
  trigger_error($e->getMessage(), E_USER_ERROR); 
} 
...

Is this normal ? I thought one of the goals of the error_handler was to catch anything that wasn't dealt with?

Thanks for your answers!

if(isset($_POST['submit'])) {
/* Doesn't show if i put it after if($_POST['submit'] */
if(isset($_POST['grand_total'])) {
echo $_POST['grand_total'];
}

}

//A bunch of other html/php code. Another class calculates the subtotal assigns it the variable $subtotal



$cart_totals = new cartTotals($subtotal, $discounted_amount,$post_values->tip); // Cart class is shown below

/* Doesn't show if i put it before if($_POST['submit'] */
if(isset($_POST['grand_total'])) {
echo $_POST['grand_total'];
}
echo  "<input name='grand_total' type='hidden' value='$cart_totals->grand_total'  />"; // Shows the grand total after second from submission
echo "$cart_totals->grand_total"; // Shows grand total after the first submission

class cartTotals  {

	public $subtotal;
	public $sales_tax;
        public $tip;
	public $grand_total;
        public $discount_amount;
	public $href_page;
	public $invalidCouponMessage;
	const  TEST_ENVIORMENT = FALSE;


	/**
	 * [ Function gets constructed in the order summary where the [$discount_amount= ""]  arg does need to be passed.
     * But does get passed in when called on the checkout.php page. Therefore we set the default value to an empty string.]
	 * @param [float] $subtotal   [subtotal get passed in from the parent class coreCartFunction]
	 * @param string $discount_amount [The class checkCouponCode calculates this discount amount based on the
     * subtotal and the discount amount. It gets instantiated on the clients side and passed is this construction function.
     * This is all done on the checkout page.]
	 */

    /*The way the construct function works is by invoking all the methods the passed arguments
    When the methods get invoked the do all the work and set the properties its values. The properties then get echoed out
    on the client side.  */
	
    function __construct($subtotal="", $discount_amount= "", $tip=""){
    
    $this->subTotal($subtotal, $discount_amount);//SubTotal method takes the discount amount and subtracts it from the subtotal.
    $this->salesTax($subtotal, $discount_amount);
    $this->tip = $tip;
    $this->grandTotal();
	}

    private function subTotal($subtotal,$discount_amount) {

            $rounded_subtotal = round($subtotal-$discount_amount,2);
            $money_format_subtotal =  money_format('%i',$rounded_subtotal);
            $this->subtotal = $money_format_subtotal;
    }


    private function salesTax($subtotal, $discount_amount =""){
	$sales_tax = (STORE_SALES_TAX)?(float)STORE_SALES_TAX:8.875;
	$sales_tax =(($this->subtotal)*$sales_tax)/100;
	$sales_tax = round($sales_tax,2);
	$this->sales_tax = $sales_tax;
	}


	public function Tip() {
    //global $post_values;
    //$last_tip_selected = $post_values->tip > 0 ? $post_values->tip : "" ;
	$tip_output = "<select id='tip' name='tip'>";
 	for($tip=0.00; $tip<=11.75; $tip+=0.25){
 	if( $tip == "2") {$selected = " selected";} else {$selected ="";}
       $formatted_tip =  money_format('%i',$tip);

	$tip_output .= "<option {$selected} id='selected_tip' value='$formatted_tip'>"."$".$formatted_tip ."</option>".PHP_EOL;
		}

		$tip_output .= "</select>";
		return $tip_output;

    }

    private function grandTotal(){
        $grand_total = round($this->sales_tax+$this->subtotal+$this->tip,2);
        $grand_total_formatted =  money_format('%i',$grand_total);
        $this->grand_total = $grand_total_formatted;

    }