I have a contact form which is an HTML-PHP hybrid.
The PHP script is meant to send the form data to an email address but it's sending the element id alone and not appending the submitted value.
Here's the code I'm using:
<?php
$ToEmail = '[email protected]';
$EmailSubject = 'Site contact form';
$mailheader = "From: ".$_POST["email"]."\r\n";
$mailheader .= "Reply-To: ".$_POST["email"]."\r\n";
$mailheader .= "Content-type: text/html; charset=iso-8859-1\r\n";
$MESSAGE_BODY = "Name: ".$_POST["name"]."";
$MESSAGE_BODY .= "Email: ".$_POST["email"]."";
$MESSAGE_BODY .= "Subject: ".$_POST["subject"]."";
$MESSAGE_BODY .= "Comment: ".nl2br($_POST["comment"])."";
mail($ToEmail, $EmailSubject, $MESSAGE_BODY, $mailheader) or die ("Failure");
?>
<form class="form-horizontal" name="contactform" action="contact.php" method="post">
<div class="control-group">
<label class="control-label" for="name">Name*</label>
<div class="controls">
<input type="text" id="name" placeholder="Name">
</div>
</div>
<div class="control-group">
<label class="control-label" for="email">Email*</label>
<div class="controls">
<input type="text" id="email" placeholder="Email">
</div>
</div>
<div class="control-group">
<label class="control-label" for="subject">Subject*</label>
<div class="controls">
<input type="text" id="subject" placeholder="Subject">
</div>
</div>
<div class="control-group">
<label class="control-label" for="comment">Message*</label>
<div class="controls">
<textarea rows="4" id="comment" placeholder="Type your message here..."></textarea>
</div>
</div>
<div class="control-group">
<div class="controls">
<p> *Required fields</p>
<button type="submit" name="submit" class="btn">Submit</button>
</div>
</div>
</form>
[email protected]\r\nHeader: injection