Question

i have already research on using the mail() to send to multiple recipient’s but i just cant get it to work. What im trying to do is, for every order that i have, order 1,2,3, each having their own email addresses, when i change their order status from pending to confirm, the mail() will use that id to refer to the db table and send the email of those 3 orders. But for my case, it mailed just the latest order which is order 3.
This is the form that i use to change the order status.

<form action="results-action" method="post" enctype="multipart/form-data">
<fieldset>


<table id ="table_id" class="display">

<thead>

<tr><td><h2>Pending Order</h2></td></tr>

<tr>
<th scope="col">Order ID</th>
<th scope="col"> </th>
<th scope="col">Name</th>
<th scope="col">Address</th>
<th scope="col">Product Name</th>
<th scope="col">Produt Quantity</th>
<th scope="col">Price</th>
<th scope="col">Order status</th>
</tr>
</thead>

<tbody>

<?php 
while ($row = mysqli_fetch_array($result)) {
?>

<tr>
<td><input type="text" value='<?=$row['virtuemart_order_id']?>' name="orderid" id="virtuemart_order_id"></td>
<td><input type="hidden" value='<?=$row['virtuemart_product_id']?>' name="productid" id="virtuemart_product_id"></td>
<td><?=$row['first_name']?></td>
<td><?=$row['address_1']?></td>
<td><?=$row['order_item_name']?></td>

<td><?=$row['product_quantity']?></td>

<td><?=$row['product_final_price'] ?></td>
<td><select name='change[<?=$row['virtuemart_order_id']?>]'>
<option value='C'> Confirmed</option>

<option value='X'> Cancelled</option></select></td>
</tr>

<?php
}
?>

</tbody>
</table>
</fieldset>



<fieldset>
<table>
<tr>
<td><input type="submit" value="Update status" name="update status"> </td>
</tr>
</table>
</fieldset>



</form>

This is the php, using the order id from the form to select the email addresses.

<?php
$orderid = $_POST['orderid'];


// build SQL statement to select email addresses
$query3 = "SELECT email from ruj3d_virtuemart_order_userinfos where virtuemart_order_id = '$orderid'";


// execute SQL statement
$result3 = mysqli_query($link, $query3) or die(mysqli_error($link)); 


$subject = "Order confirmed by Home and decor";
$message = "Hello! This is a message to inform that your order has been confirmed";
$from = "[e-mail]";
$headers = "From: $from";

while($row3 = mysqli_fetch_array($result3)){ 

$addresses[] = $row3['email'];

}

$to = implode(",", $addresses);



mail($to, $subject, $message, $headers);

?>

Answer 1

You are using the wrong $_POST field to select your email addresses.

The form generated by the first php file contains a table, with each row containing an input field named 'orderid'. But the field you are really interested in is the select input value of each row. These are all stored in one single array named change in the $_POST array.

Here’s an example of how $_POST could be initialized to correspond to the select values being returned by the form:

$_POST['change'] = array('id1' => 'C', 'id2' => 'X' /*, 'id3' => ... */ );

So you need to:

• get the array returned by the form in $_POST,
• filter out the entries which aren’t equal to ‘C’,
• keep the keys of these entries,
• escape them to sanitize them,

You should replace the beginning of your php file with the following, which does as explained above.

This first version doesn’t sanitize the entries:

<?php

function confirmed($v) { return ($v == 'C'); }

// pick the rows in your form table which have been set as confirmed, and use the keys 
$orderid = implode(',', array_keys(array_filter($_POST['change'],'confirmed')));

// build SQL statement to select email addresses
$query3 = "SELECT email FROM ruj3d_virtuemart_order_userinfos WHERE virtuemart_order_id IN (".$orderid.")";

// etc.

This one does sanitization:

<?php

function confirmed($v) { return ($v == 'C'); }

// pick the rows in your form table which have been set as confirmed, and use the keys 
$orderid = implode(',', array_map('mysql_real_escape_string', 
                                  array_keys(array_filter($_POST['change'],'confirmed'))));


// build SQL statement to select email addresses
$query3 = "SELECT email FROM ruj3d_virtuemart_order_userinfos WHERE virtuemart_order_id IN (".$orderid.")";

// etc.

See this SO question for the use of BCC with the mail() function.