PHP - Help Converting A Form To A Php Script - Paypal Related

I wrote this basic script yesterday to process and generate a Google Site Map. And it works! BUT I want to advance this script to accommodate for something else and I don't know the correct path to take from here, but I will tell you what I've found out so far..

Current Situation:

1 - Currently my below script generates urls in the site map like:
http://abcdefg.com/index.php?dispatch=products.view&product_id=29826

2 - I have .htaccess configured to rewrite the urls to the products name data like:
http://abcdefg.com/pennies/wheat-pennies/lincoln-wheat-penny-cent.html (just an example) and these urls are ONLY active if clicking on the site links themselves - meaning if I enter: http://abcdefg.com/index.php?dispatch=products.view&product_id=29826 directly into the url, the url does not resolve to this natural friendly url name.

What Id like to achieve (which I don't know what direction I should be looking!):

- I'd like my xml output urls (as current) to be written in the natural format (as in #2 above).

FYI here is a current example output item in my sitemap:

Code: [Select]
<url>
  <loc>http://abcdefg.com/index.php?dispatch=products.view&amp;product_id=29803</loc>
  <changefreq>weekly</changefreq>
  <lastmod>2010-09-24T08:00:00+04:00</lastmod>
 </url>
Can anyone give me some guidance on what method might work for this? Do you think it's more a mod_rewrite issue? Or can this be handled easier with straight up modifications to my below? I'm just a bit confused on what direction I should be looking.. Thanks for any input.

<?php
header("Content-Type: text/xml;charset=iso-8859-1");
  echo '<?xml version="1.0" encoding="UTF-8"?>
<urlset xmlns="http://www.sitemaps.org/schemas/sitemap/0.9">';
 //include('config.local.php');
  $cxn = mysqli_connect($config['db_host'], $config['db_user'], $config['db_password'], $config['db_name']);
  $query = "SELECT cscart_product_descriptions.product_id, cscart_products.product_id, cscart_products.timestamp
FROM cscart_product_descriptions JOIN cscart_products ON cscart_product_descriptions.product_id = cscart_products.product_id
WHERE cscart_products.status='A' LIMIT 10000";
  $result = mysqli_query($cxn, $query);
  $row = mysqli_fetch_array($result);
  while ($row = mysqli_fetch_array($result)) {
  $formatedTime = $row['timestamp'];
      echo '<url>
  <loc>http://abcdefg.com/index.php?dispatch=products.view&amp;product_id=' . $row['product_id'] . '</loc>
  <changefreq>weekly</changefreq>
  <lastmod>'. date('c',$formatedTime) .'</lastmod>
  </url>';
  } //while ($row = mysqli_fetch_array($result))
  echo '</urlset>';
?>

Hi, i'm basically having problems with this code, its for a newsletter script which added the email address into a file, i'm trying to convert it to work with mysql but having a few problems;

I've edited the last bit, the code just basically doesn't add it to the database even though i thought i had done it right...

any help is very much appreciated!

If email is not valid the script is letting me know; if email is valid it says "already added to the list" no matter what.

old script
<?php
/** BY WebResourcesDepot - http://www.webresourcesdepot.com*/
/** YOU CAN EDIT HERE*/
$newsletterFileName = "file.txt";

/** IMPORTANT: EDIT BELOW UNLESS YOU KNOW WHAT YOU ARE DOING*/
function GetField($input) {
    $input=strip_tags($input);
    $input=str_replace("<","<",$input);
    $input=str_replace(">",">",$input);
    $input=str_replace("#","%23",$input);
    $input=str_replace("'","`",$input);
    $input=str_replace(";","%3B",$input);
    $input=str_replace("script","",$input);
    $input=str_replace("%3c","",$input);
    $input=str_replace("%3e","",$input);
    $input=trim($input);
    return $input;
} 



/**Validate an email address.
Provide email address (raw input)
Returns true if the email address has the email 
address format and the domain exists.
*/
function validEmail($email)
{
   $isValid = true;
   $atIndex = strrpos($email, "@");
   if (is_bool($atIndex) && !$atIndex)
   {
      $isValid = false;
   }
   else
   {
      $domain = substr($email, $atIndex+1);
      $local = substr($email, 0, $atIndex);
      $localLen = strlen($local);
      $domainLen = strlen($domain);
      if ($localLen < 1 || $localLen > 64)
      {
         // local part length exceeded
         $isValid = false;
      }
      else if ($domainLen < 1 || $domainLen > 255)
      {
         // domain part length exceeded
         $isValid = false;
      }
      else if ($local[0] == '.' || $local[$localLen-1] == '.')
      {
         // local part starts or ends with '.'
         $isValid = false;
      }
      else if (preg_match('/\\.\\./', $local))
      {
         // local part has two consecutive dots
         $isValid = false;
      }
      else if (!preg_match('/^[A-Za-z0-9\\-\\.]+$/', $domain))
      {
         // character not valid in domain part
         $isValid = false;
      }
      else if (preg_match('/\\.\\./', $domain))
      {
         // domain part has two consecutive dots
         $isValid = false;
      }
      else if
(!preg_match('/^(\\\\.|[A-Za-z0-9!#%&`_=\\/$\'*+?^{}|~.-])+$/',
                 str_replace("\\\\","",$local)))
      {
         // character not valid in local part unless 
         // local part is quoted
         if (!preg_match('/^"(\\\\"|[^"])+"$/',
             str_replace("\\\\","",$local)))
         {
            $isValid = false;
         }
      }
   }
   return $isValid;
}


$email  = GetField($_GET['email']);
$pass  = validEmail($email);

if ($pass) {
$f = fopen($newsletterFileName, 'a+');
$read = fread($f,filesize($newsletterFileName));
If (strstr($read,"@")) {
$delimiter = ";";
}
if (strstr($read,$email)) { 
echo 3;
} else {
fwrite($f, $delimiter . $email);
echo 1;
}
fclose($f);
} else {
echo 2;
}
?>

edited script
<?php
/** BY WebResourcesDepot - http://www.webresourcesdepot.com*/
/** YOU CAN EDIT HERE*/
$newsletterFileName = "file.txt";

/** IMPORTANT: EDIT BELOW UNLESS YOU KNOW WHAT YOU ARE DOING*/
function GetField($input) {
    $input=strip_tags($input);
    $input=str_replace("<","<",$input);
    $input=str_replace(">",">",$input);
    $input=str_replace("#","%23",$input);
    $input=str_replace("'","`",$input);
    $input=str_replace(";","%3B",$input);
    $input=str_replace("script","",$input);
    $input=str_replace("%3c","",$input);
    $input=str_replace("%3e","",$input);
    $input=trim($input);
    return $input;
} 



/**Validate an email address.
Provide email address (raw input)
Returns true if the email address has the email 
address format and the domain exists.
*/
function validEmail($email)
{
   $isValid = true;
   $atIndex = strrpos($email, "@");
   if (is_bool($atIndex) && !$atIndex)
   {
      $isValid = false;
   }
   else
   {
      $domain = substr($email, $atIndex+1);
      $local = substr($email, 0, $atIndex);
      $localLen = strlen($local);
      $domainLen = strlen($domain);
      if ($localLen < 1 || $localLen > 64)
      {
         // local part length exceeded
         $isValid = false;
      }
      else if ($domainLen < 1 || $domainLen > 255)
      {
         // domain part length exceeded
         $isValid = false;
      }
      else if ($local[0] == '.' || $local[$localLen-1] == '.')
      {
         // local part starts or ends with '.'
         $isValid = false;
      }
      else if (preg_match('/\\.\\./', $local))
      {
         // local part has two consecutive dots
         $isValid = false;
      }
      else if (!preg_match('/^[A-Za-z0-9\\-\\.]+$/', $domain))
      {
         // character not valid in domain part
         $isValid = false;
      }
      else if (preg_match('/\\.\\./', $domain))
      {
         // domain part has two consecutive dots
         $isValid = false;
      }
      else if
(!preg_match('/^(\\\\.|[A-Za-z0-9!#%&`_=\\/$\'*+?^{}|~.-])+$/',
                 str_replace("\\\\","",$local)))
      {
         // character not valid in local part unless 
         // local part is quoted
         if (!preg_match('/^"(\\\\"|[^"])+"$/',
             str_replace("\\\\","",$local)))
         {
            $isValid = false;
         }
      }
   }
   return $isValid;
}


$email  = GetField($_GET['email']);
$pass  = validEmail($email);

if ($pass) {

$user_name = "_db";
$password = "";
$database = "_db";
$server = "localhost";
$db_handle = mysql_connect($server, $user_name, $password);
$db_found = mysql_select_db($database,  $db_handle);
if ($db_found) {
$SQL2 = "SELECT * FROM newsletter WHERE email = '$_GET[email]'";
$result = mysql_query($SQL2);
mysql_close($db_handle); }

if (strstr($SQL2,$email)) { 
echo 3;
} else {
$user_name = "_db";
$password = "";
$database = "_db";
$server = "localhost";
$db_handle = mysql_connect($server, $user_name, $password);
$db_found = mysql_select_db($database,  $db_handle);
if ($db_found) {
$SQL = "INSERT INTO newsletter (email,subscribed) VALUES ('$_GET[email]',1)";
$result = mysql_query($SQL);
mysql_close($db_handle);}
echo 1;
} } else {
echo 2;
}
?>

Some of you may have seen one of my many posts about email issues.  Some users don't get them, and I have determined it is probably because we are marked as spam.   We are a service that grades sales team members on their phone skills.  Listening to pre-recorded calls, grading and uploading them to our site, and then another part of our business looks them over and sometimes leaves a message that then get's forwarded to this persons work email.   I have determined there is ways to get marked as spam as default by not having an opt out link.  This is not an option, these sales members employer has opted in, and the emails are going to work related accounts hosted at that employer.  Also, if one of these staff members is not so bright, or disgruntled they may mark us as spam anyways.  The bottom line is that we have very little control over whether we are or are not marked as spam.   So we want to start looking into sending text messages and this is where I start to question how good of an idea this is.   First off, if it was me, and the messages where being sent to a device that my employer did not provide, I would in no way want work related text messages coming to me.  Unless there is a vested interest in getting them.  IE, I'm the boss at this place and am always on the clock.  What if you are on the bottom?  It's just a job for you.   What if it is a pre-paid device, text messages cost money.  What then?  What if they don't even have, or want a cell phone?   The short of it is this.  If I'm at a job that is just another job, and this employer tells me that I have to get these messages.  I'm going to look for another job.  I see the organizations having continuous issues and complaints from their employees.  Thus us as a business having issues keeping clients.   What am I getting into here?  What are your opinions on this matter?  What are your recommendations as to alerting users of something on our site that we can rest assured are being received 100% of the time?   Thanks!   Nick

I am working on convering an old PHP form mail script to do error checking on the same page as the form rather then using redirects and I am having a bit of trouble with the logic. Right now it seems to work okay in general, but will send blank emails without doing the error check. Can someone please help me get it sorted out so that it works correctly. Also any ideas or input on how to make it more secure are appreciated.

Thanks in advance,

kaiman

Here is the section of code in question:

Code: [Select]
// validate form
if(isset($_POST['submit'])){

// check for empty form fields
if (empty($name) || empty($email) || empty($category) || empty($formsubject) || empty($message)) {
echo "<p>Please complete all required form fields.</p>";
}

// sanitize and validate email address
$email = filter_var($_POST['email'], FILTER_SANITIZE_EMAIL) ; 

if (!filter_var($email, FILTER_VALIDATE_EMAIL)) { 
echo "<p>Please enter a valid email address.</p>";
}

// check for special characters in the message field and reformat
if (get_magic_quotes_gpc()) {
$message = stripslashes($message);
}
}
if(isset($_POST['email'])){
// if valid send email
mail($mailto, $subject, $messageproper,
"From: \"$name\" <$email>\r\n" . "Reply-To: \"$name\" <$email>\n" . "X-Mailer: PHP 5.2.5" );
header( "Location: $successurl" );
}
else {
echo "<!-- begin form -->\n";
echo "<form name=\"Contact\" class=\"contentform\" method=\"post\" action=\"" . $_SERVER['REQUEST_URI'] . "\">\n";
echo "<fieldset>\n";
echo "<legend>Contact Form</legend>\n";
echo "<ol class=\"form\">\n";
echo "<li class=\"formleft\">\n";
echo "<label for=\"name\"><span class=\"asterisk\">&#042;</span> Your Name:</label>\n";
echo "<input class=\"textfield\" id=\"name\" name=\"name\" type=\"text\" value=\"\" />\n";
echo "</li>\n";
echo "<li class=\"formright\">\n";
echo "<label for=\"email\"><span class=\"asterisk\">&#042;</span> Email Address:</label>\n";
echo "<input class=\"textfield\" name=\"email\" type=\"text\" id=\"email\" value=\"\" />\n";
echo "</li>\n";
echo "<li class=\"formleft\">\n";
echo "<label for=\"category\"><span class=\"asterisk\">&#042;</span> Form Category:</label>\n";
echo "<select class=\"select\" name=\"category\" id=\"category\" onchange=\"javascript:enableOther();\">\n";
echo "<option value=\"\">Please Select an Option:</option>\n";
echo "<option value=\"Question\" >Question</option>\n";
echo "<option value=\"Comment\" >Comment</option>\n";
echo "<option value=\"Idea\">Idea</option>\n";
echo "<option value=\"Other\">Other</option>\n";
echo "</select>\n";
echo "</li>\n";
echo "<li class=\"formright\">\n";
echo "<label for=\"formsubject\"><span class=\"asterisk\">&#042;</span> Form Subject:</label>\n";
echo "<input class=\"textfield\" name=\"formsubject\" type=\"text\" id=\"formsubject\" value=\"\" />\n";
echo "</li>\n";
echo "<li>\n";
echo "<label for=\"message\"><span class=\"asterisk\">&#042;</span> Your Message:</label>\n";
echo "<textarea name=\"message\" class=\"textarea\" rows=\"5\" cols=\"20\" id=\"message\" value=\"\"></textarea>\n";
echo "</li>\n";
echo "<li>\n";
echo "<label for=\"submitbutton\"></label>\n";
echo "<button class=\"submitbutton\" type=\"submit\" name=\"submit\" title=\"Submit\">Submit</button>\n";
echo "</li>\n";
echo "</ol>\n";
echo "</fieldset>\n";
echo "</form>\n";
echo "<!-- end form -->\n";
}

Hi, I'm new to PHP and have dabbled a little but need some help or someone to point me in the right direction if possible.

I have an ajax web-form that sends the inputed data to a php file and then emails the results to the designated address (all working fine).

However, what I am looking to do is have the php file (in addition to the current function) convert the data into XML and then attach the XML file to the email that is sent out.

As mentioned I'm new to php and have a small amount of knowledge so any help on this would be very much appreciated.

Cheers