Question

I have a website, and in the “Contact” section I have a form which users may fill in to contact me.
The form is a simple form which action is a php page.

The php code:

 $to = "[e-mail]";

 $name=$_POST['name']; // sender name
 $email=$_POST['email']; // sender email
 $tel= $_POST['tel']; // sender tel
 $subject=$_POST['subject']; // subject CHOSEN FROM DROPLIST, ALL TESTED
 $text=$_POST['text']; // Message from sender
 $text.="\n\nTel:".$tel; // Added to message to show me the telephone nr to the sender at bottom of message

 $headers="MIME-Version: 1.0"."\n";
 $headers.="Content-type: text/plain; charset=UTF-8"."\n";
 $headers.="From: $name <$email>"."\n";

 mail($to, '=?UTF-8?B?'.base64_encode($subject).'?=', $text, $headers, '[e-mail]');

Could somebody please tell me why this works most of the time, but sometimes I receive email whith no text and the subject line showing

=?UTF-8?B??=

I use outlook express, and I have read this System.Net.Mail and =?utf-8?B?XXXXX…. Headers
but it didn’t help.

The problem is not in Outlook, because when I log in to the actual mailprogram where I fetch the POP3 emails from, the email looks the same.

When I right click in Outlook and chose “message source” then there is no “From” information.

Ex, a good message should look like this:

Subject: =?UTF-8?B?w5Z2cmlndA==?=
MIME-Version: 1.0
Content-type: text/plain; charset=UTF-8
From: John Doe 

However, the ones with problem looks like this:

Subject: =?UTF-8?B??=
MIME-Version: 1.0
Content-type: text/plain; charset=UTF-8
From:  

As if the information has been lost somewhere.

You should know also that I have a VPS, which I manage myself.
I use postfix as an emailserver, if thats got anything to do with it.
But then again, why does it work sometimes?

Also another thing that I have noticed is that sometimes special characters are not shown correctly (by both Outlook and the webmail).

For instance, the name “Björkman” in swedish is shown like Björkman, but again, only sometimes.

I hope anybody knows something about this problem, because it is very hard to track down for me atleast.

If you need more input let me know.

Answer 1

Looks like the form is posted with all fields left blank. There are bots crawling the net and submitting empty forms. Have you been able to reproduce this with actual form data?

Additional hint: your code is open to email header injection – I can post any headers I want, separated by line breaks, in $_POST[‘name’] and your code will put it into the email headers. At least remove any line breaks from user data that will go into the header section.