How does PHP format echos and emails?

[dog]

Even when using the Location header - which usually generates a 302 Found response - a short HTML message should be included.

The temporary URI SHOULD be given by the Location field in the response. Unless the request method was HEAD, the entity of the response SHOULD contain a short hypertext note with a hyperlink to the new URI(s).

— 10.3.3 302 Found, RFC 2616 Hypertext Transfer Protocol — HTTP/1.1

Ok, I'll put one in if you can tell me how. Please remember I'm really new to PHP and haven't had much time free to do much reading up.

If the elements don't exist within the super-global array, notices will be sent to the error log. Test that the elements exist first, then assess the values.

I'm testing their existance manually, I think. I'm testing over and over again and if they don't exist in the form I'd know about it. As I'm sure that they exist is it neccessary to test for them using the PHP code? I don't understand the advantages to doing this in my current situation. Are there any?

And if the e-mail address isn't actually an e-mail address, or the name is just white space?

Ok, so what alternative should I know about? I've got very limited experience of PHP and until I come across other options I'm going to make do with what I've got. I don't know how to validate a name or email any better than this.

I do however have more questions:

You suggested this script:

...(string literal split for readability only)

"Password reminder:\r\n\r\n\r\n"
    . "Username: {$username}\r\n"
    . "Password: monkey\r\n\r\n"
    . 'Please log-in at <http://torema.com.br/cases.php>' 

I didn't really understand what you meant by string literal split. I've tried closing and opening the string with quotation marks (') but ever time I do I cause errors.

For example, I'm trying to write a string (terminology?) called $message1 and I find it convenient to split it into several lines but in doing so I'm causing errors. Anyone who likes could tell me what's causing them in the following code. All of this code is meant to be a definition of $message1.

$message1 = 'E-mail do Site da Pagina: Fale Conosco\r\n\r\n'

'Nome: {$name}\r\n'
'Cargo: {$company}\r\n'
'Empresa: {$company}\r\n'
'Cidade: {$city} / {$state}'

//if the country is anything other than Brasil state it
if ($country=='Brasil')
{ echo '\r\n\r\n';}
//otherwise leave it out
else
{ echo '\r\n\r\n';}

'Intressa: {$interest}\r\n'
//if there is a message echo it
if ($message=='')
{ echo '\r\n';}
else
{ echo 'Mensagem: '.$message.' \r\n';}

'Deseja Contato Por: {$contactType}\r\n'
'Horario de Contato: {$timeTable}\r\n\r\n'

'Fone: {$tel}\r\n'
'E-mail: {$email}\r\n'
'Site: www.{$site}\r\n'; 

You'll notice there is another issue involved in this script. I"ve got no idea if I can use if-else statements and echos like this. I hope they at least give the impression of what it is I'm trying to do.

Thanks to all.

dog

[mwinter]

Even when using the Location header - which usually generates a 302 Found response - a short HTML message should be included.

Ok, I'll put one in if you can tell me how.

Perhaps the easiest approach in the short term is to drop out of PHP parsing mode after sending the header, output the HTML, then re-enter PHP mode and call the exit function:

$host = $_SERVER['HTTP_HOST'];
$path = rtrim(dirname($_SERVER['PHP_SELF']), '/') . '/form.php';
$uri = 'http://' . $host . $path;

header('Location: ' . $uri);
/* Drop out of PHP */
?>
<!DOCTYPE ...>

<!-- ... -->
<a href="<?php echo $uri ?>">...</a>
<!-- ... -->
<?php
exit();

Parts have clearly been omitted, but after filling out the HTML part in the middle, you should be able to drop this in place of the code you posted previously that set the Location header.

I'm testing their existance manually, I think.

The isset function tests for existence, though some array functions could be used, too.

I'm testing over and over again and if they don't exist in the form I'd know about it. As I'm sure that they exist is it neccessary to test for them using the PHP code?

Yes, because you cannot be sure that they exist. Never trust user input. Don't assume it will always be there, and never assume that it will be what it's supposed to be. Such assumptions lead to broken code and security issues.

I don't understand the advantages to doing this in my current situation. Are there any?

One should ensure that elements exist in arrays before attempting to access them. It's simply how things should be done. At the very least, it avoids the unnecessary generation of log entries.

And if the e-mail address isn't actually an e-mail address, or the name is just white space?

Ok, so what alternative should I know about?

As I wrote previously: regular expressions. You can find code for validating e-mail addresses on the Web. Google is your friend. Simply ensuring that input contains more than white space can be implemented with:

if (!isset($_POST['name'])
        || !preg_match('/\\S+/', ($name = trim($_POST['name'])))) {
    /* Name missing or only white space */
}
/* The name can be referred to by $name */ 

If the input comes from query string data, substitute $_POST for $_GET.

You suggested this script:

...(string literal split for readability only)

"Password reminder:\r\n\r\n\r\n"
    . "Username: {$username}\r\n"
    . "Password: monkey\r\n\r\n"
    . 'Please log-in at <http://torema.com.br/cases.php>' 

I didn't really understand what you meant by string literal split.

Not much: if the string was written as one long literal, it would have been (more) difficult to read and would have caused horizontal scrolling within the code box. Instead, I split it into several - four - smaller literals and concatenated them using the string concatenation operator (.).

For example, I'm trying to write a string (terminology?)

To define a few terms, a literal is a representation of some sort of value in source code. Each basic data type - primitive - has a literal form.

Strings are sequences of characters: text. They are usually included in quotes (' or "), though another form does exist. Variable expansion - replacing a variable name with its value - doesn't occur in the single-quote form of a string literal. That is,

$foo = 'bar';
echo 'Value: $foo'; 

would output "Value: $foo" not "Value: bar". The range of escape sequences is also reduced in the single-quote form: only \\ (single backslash) and \' (single quote) are processed.

I generally use the single-quote form whenever possible as the PHP parser will process them slightly quicker due to their simplicity, but it doesn't really matter that much.

Numbers and booleans (true/false) also have literals forms:

$hundred = 100;
$third = 0.66666;
$c = 3e8;  // 300000000
$isReady = true; 

called $message1 and I find it convenient to split it into several lines but in doing so I'm causing errors. Anyone who likes could tell me what's causing them in the following code. All of this code is meant to be a definition of $message1.

$message1 = 'E-mail do Site da Pagina: Fale Conosco\r\n\r\n'

'Nome: {$name}\r\n'
'Cargo: {$company}\r\n'
'Empresa: {$company}\r\n'
'Cidade: {$city} / {$state}'

//if the country is anything other than Brasil state it
if ($country=='Brasil')
{ echo '\r\n\r\n';}
//otherwise leave it out
else
{ echo '\r\n\r\n';}

'Intressa: {$interest}\r\n'
//if there is a message echo it
if ($message=='')
{ echo '\r\n';}
else
{ echo 'Mensagem: '.$message.' \r\n';}

'Deseja Contato Por: {$contactType}\r\n'
'Horario de Contato: {$timeTable}\r\n\r\n'

'Fone: {$tel}\r\n'
'E-mail: {$email}\r\n'
'Site: www.{$site}\r\n'; 

You aren't concatenating each literal with the next. A full stop (period) is the operator used here.

/* Notice the change in quotation mark. This is necessary to replace escape
 * sequences with the respective character, and to perform variable expansion.
 */
$message1 = "E-mail do Site da Pagina: Fale Conosco\r\n\r\n"
    . "Nome: {$name}\r\n"
    . "Cargo: {$company}\r\n"
    . "Empresa: {$company}\r\n"
    . "Cidade: {$city} / {$state}";

/* If country is not Brazil, include it in the message. */
if ($country != 'Brazil') {
    $message1 .= "Country: {$country}";
}
$message1 .= "\r\n\r\n"
    . "Intressa: {$interest}\r\n";

/* If there is a user-defined message, add it. */
if ($message != '') {
    $message1 .= "Mensagem: {$message}";
}
$message1 .= "\r\n"
    . "Deseja Contato Por: {$contactType}\r\n"
    . "Horario de Contato: {$timeTable}\r\n\r\n"
    . "Fone: {$tel}\r\n"
    . "E-mail: {$email}\r\n"
    . "Site: www.{$site}\r\n"; 

You might want to choose a better name than $message1.

There's another way to write the code above without if statements. Instead, one could use the conditional operator, which is almost like an if statement for use in expressions, but we can leave that for another time.

You'll notice there is another issue involved in this script. I"ve got no idea if I can use if-else statements and echos like this.

The if statements are fine, though as you can see, it interrupts the process of building the string a little. As for the echo construct, this is meant for sending the value of string as output. For server-side PHP, this means transmitting it to the browser.

I hope they at least give the impression of what it is I'm trying to do.

I believe so.

Mike

[dog]

Hi Mike,

Thanks for all the info.

I'll update my script and post up the things I'm not sure of afterwards.

The script is working ok at the moment, as in it does most of the things I want it to but I've hit upon one major problem.

I think this comes back to a point you made previously:

I'm not familiar with how you're organising this. Do you mean that you're submitting the form to a different URI then trying to redirect back to the previous URI? If so, it would easier to submit the form to the same URI and change what's sent to the browser based on whether the visitor is requesting the document for the "first" time, or as a result of the submission.

I didn't understand what you meant by change what's sent to the browser based on whether the vistor is requesting the document for the "first" time, or as a result of the submisson. Would this be the difference between form.php and form.php?sent=yes?

Currently I am submitting the form to a different URI. How would the form be submitted if it didn't go to a different URI?

I think the problem I'm having could be solved somehow by staying at the same URI. What is occuring is that if the form has not been fully filled out the user is returned to the form to fill out all of the required fields, the page is reloaded and the form is cleared so all of the work they've already done in filling out some of the fields is lost.

I don't know what I can do about this. Any suggestions?

[mwinter]

I didn't understand what you meant by change what's sent to the browser based on whether the vistor is requesting the document for the "first" time, or as a result of the submisson. Would this be the difference between form.php and form.php?sent=yes?

Not exactly, though that's a rudimentary way of doing it.

Currently I am submitting the form to a different URI. How would the form be submitted if it didn't go to a different URI?

Requesting a document and submitting a form are the same thing. The only difference between the two is that the latter sends some extra data, either in the query string, or the body of the request (which is usually empty).

When submitting form data to the same document that contained the form in the first place, the first step is to distinguish between submission and a normal request. Based on that test, the script can vary what information it sends back to the browser.

I think the problem I'm having could be solved somehow by staying at the same URI. What is occuring is that if the form has not been fully filled out the user is returned to the form to fill out all of the required fields, the page is reloaded and the form is cleared so all of the work they've already done in filling out some of the fields is lost.

I don't know what I can do about this. Any suggestions?

To retain typed values, the value attribute of each control can be initialised to the submitted value. Similarly, the selected attribute can be added to items that were selected in a list, and the checked attribute to chosen radio buttons and checkboxes. The isset function can be used to indicate whether a value was sent. For example,

<input name="last-name" type="text" value="<?php
if (isset($_POST['last-name'])) {
    echo $_POST['last-name'];
}
?>">

This would work whether the form was submitted, but perhaps with errors, or when the form is requested for the first time. In the latter case, the isset test would fail and nothing would be written into the value attribute.

The basic process is:

1. If no form input received, go to 6.
2. If any required input missing, or any received input is invalid, go to 6.
3. Process input data.
4. Either redirect or return response (results of step 3, for example).
5. Go to 7.
6. Return form, including any received input, and error messages for invalid data.
7. Exit.

Note that step 1 isn't an error condition, unlike step 2.

There are different ways of implementing this, varying in sophistication. The structure of the form and the way in which error messages are to be presented also greatly affect implementation choices.

My Internet connection is very intermittent at the moment. If you need urgent help over the next few days whilst my provider gets its act together, someone else will probably have to give it.

Mike