A PHP Contact Form for your Site

Thanks for the comments, Pali. The Books for Learning project is coming along very slowly, but hopefully I’ll get there.

@Andy.
Thanks for the comments. I used to have an RSS feed, but decided not to include it in the latest update, as I don’t get the sense people use it much any more. Anyhow, will reconsider. And I do hope to post more soon.

@Matt
You can indeed add a CC email address. There are various ways.

One way is to send a separate email to the second person with the mail() function. Firstly, at the top of the form code, add a second email address:

$another_email = "[email protected]";

Then add another mail() line lower in the script, after the first one:

mail ($your_email, $subject, $email_body, "From: $nam <$ema>" . "\r\n" . "Reply-To: $nam <$ema>");
mail ($another_email, $subject, $email_body, "From: $nam <$ema>" . "\r\n" . "Reply-To: $nam <$ema>");

But if you want a genuine CC address, where the first recipient sees that the email has been CCed to someone else, you can simply add an extra bit to the original mail() function, like this (see the end bit):

mail ($your_email, $subject, $email_body, "From: $nam <$ema>" . "\r\n" .
"Reply-To: $nam <$ema>" . "\r\n" . "CC: name2@mailhost.com");

Hope that helps.

@Yuccy Yucca—glad you found it useful. Thanks for the feedback!

@Hamed—I’m afraid I don’t quite understand the question. Can you say a bit more about what you are trying to do?

@Click in webstudio

Hm, it looks like your setup is OK, although don’t forget to include the thankyou.html file as well.

Did you also set an appropriate subject line? Make sure to check your spam folder, as some emails can be sent there is the subject line or contents seem to be fishy.

Looking up your domain, it seems you have Windows hosting, and I admit I don’t know how well this code will work on that platform. I’m only familiar with Apache. So that may be part of the problem.

I can’t really help much more without access to your site, as this is a backend issue. Feel free to contact me if you wish, though I may not be much use in a Windows environment. Unfortunately, there’s only so much help I can give in a comment thread. The code is basically given “as is”, I’m afraid, though I’m happy to help if I can.

@Hamed—

Can you make this form support utf-8 in fields and comment?

Yes indeed. You can add the Content-Type to the fourth part of the mail( ) function, like so:

"From: $nam <$ema>" . "\r\n" . "Reply-To: $nam <$ema>"
. "\r\n" . "Content-Type: text/plain; charset=utf-8"

Can you add a subject field to this form?

Yes. The form comes with a default subject line, which you add to the top of the script. If you want the user to be able to type a subject instead, you can add an extra form field. The easiest way to do this is to duplicate the Name field—both in the form and in the processing code, but changing the name, id etc. to something unique. Let me know if you have any trouble with that.

Can you make emails send to inbox instead of spam folder?

There are various things you can do. Firstly, make sure the subject line you choose is not spammy. Secondly, you can help convince email clients / mail servers that the email is coming from a respected source by setting up email authenticating with DKIM or creating and SPF record.

Hope that helps.

That’s a good question, Hamed!

I did a bit of googling, and it seems there are various ways to allow Arabic characters to pass through preg_match() validation, such as /^[\s\p{Arabic}]+$/u. An example of this incorporated into the Name field would be this:

preg_match("/^[A-Za-z\-'\s\p{Arabic}]+$/u", $nam)

An example of the comment field would be this:

preg_match("/^[A-Za-z\.,\-\/'\(\)!\?\s\p{Arabic}]+$/u", $com)

These allow for various punctuation marks, English and Arabic letters etc. See if that helps. You’ll also need to update the error messages, such as this for the Name field:

The name field must contain only English and/or Arabic letters, spaces, dashes ( - ) and single quotes ( ’ )

Hi saiko.

Could you include reCaptcha Spam blocking option in it?

I’m not keen on CAPTCHA—no matter what the flavor. It penalizes the user as much as the spammer.

Instead, I’ve added a honeypot timer—a hidden field that compares the time of the page load and the time of submission. This will trip up bots while leaving your legitimate visitors alone entirely.

I’ve found that the “honeypot” method works really well to prevent bot spam. I never get any at all.

I’m glad you found this useful, saiko, and thanks for the compliment.

Thanks very much, janoooosh! Your comments are appreciated, and your tips about S3 are very interesting.

Hi kg. That’s a good question. I haven’t used this on MAMP before, but I’ve read that MAMP isn’t configured to do it by default. From what I’ve read online, you need to change a setting to allow emails to be sent. So give this a try and see if it works:

Go to your Applications folder, choose MAMP > conf > php5.3 (or whatever version you use) > php.ini (open this in your preferred code editor).

Then find the line that reads something like—

; For Unix only.  You may supply arguments as well (default: "sendmail -t -i").
;sendmail_path =

I’ve read various suggestions, from changing the second line to—

sendmail_path = /usr/sbin/sendmail -t -i

to doing this—

sendmail_path = /usr/sbin/sendmail -t -i -f  [email protected]

(Note that the ; character must be removed from the start of the line.)

The latter option will only allow you to email from your email back to your own email again, as I understand it. Make sure to save the php.ini file and to restart MAMP before you test the form again.

As I say, I haven’t tested this, but I really should! Anyhow, hope that helps.

Hi Dante. I don’t see the page there, but anyhow, one thing you can do is to place this code temporarily at the top of your PHP file:

<?php

error_reporting(E_ALL|E_STRICT);

That will hopefully show up and PHP errors. If that reveals nothing, I’d have to look at your setup to be able to get a better idea.

OK, from a quick glance, the script seems to be working OK. So it might be something minor in your settings. If you want to send me your process.php file via email, I’ll have a look at it for you.

Hi spirobg. A similar question came up in this comment, where Arabic characters were involved. Similarly to that situation, you can add \p{Cyrillic} to the preg_match() lines to allow for Cyrillic characters.

For future reference, here is a list that targets a wide range of languages.

Hi Andy. Certainly with the ‘internal’ version of the script, the original form is echoed onto the same page, along with error messages, and you could just echo the bit that needs to be fixed and store the rest for sending ... although there may be times when the user will want to review other parts of the form. But with PHP, you still have to refresh the page.

Another option is to use JS on the front end to help with error messages etc., which would allow what you are asking for without a page refresh.

Both options are a bit beyond the scope of the basic code I’ve presented here, though.

Hi Andy. I’m not sure what to say about the parsing error, except that something added to the page may be causing it?

In terms of the echoed content, you can’t have PHP inside that, but you can break the echo statement up into chunks, like so:

echo 'some echoed content';
<?php include $_SERVER["DOCUMENT_ROOT"] . "/includes/xxxx.php"; ?>
echo 'more echoed content';

As for the closing ?>, the recommendation is not to use it on files that just contain PHP, which is why I left it off, but it’s fine to put it back in there if you want.

No worries, Andy. Hoe it all works out, but feel free to follow up if needed. I’m no PHP expert, but see so many people who need contact form code that it seemed worth making something available. There are no doubt much better scripts out there, but this one works for my simple purposes.

when I click submit/send it brings the PHP up in the next webpage

Hi Ally. It sounds like PHP is not running on your site. To check what’s happening with PHP on your site, follow the instructions in my Checking Your PHP Configuration post. Good luck!

Hi Michael. Yes, that’s beyond the scope of the simple script I’ve posted here, but it involves allowing for file uploads. There’s a huge number of articles online about setting this up, such as this: http://webcheatsheet.com/php/file_upload.php

Hi Jen. I’m glad you had some success. It’s odd, though, because all three pages should work. The problem probably isn’t the $contact_page setting, as that doesn’t really affect anything unless someone tries to go directly to the process.php page.

The main question is where those contact.html and process.html pages are located. If they aren’t in the same folder as the index.html page, then they won’t be able to find the process.php page if you just set action=“process.php” on the form, because that points to the same folder as the page the form appears on.

If that’s the problem, then there are two options. Either change the action of the form to point to the process file (e.g. action=”/contact/process.php” etc.) or you could just duplicate the process.php file and place one for each contact form in the same folder as the page calling that file.

Hope that helps. Let me know if I’ve made the wrong assumption about your file setup.

EDIT: I tested your forms and they seemed to work OK. I see that all files are in the same folder. Did you get the emails I sent? I sent one from the Projects page and one from the Contact page.

That’s great, Jen. Glad it’s all working. The form is quite secure as is, so you shouldn’t need any extra security. It locks down very tightly what users can enter, meaning that they can’t do anything malicious.

EDIT: I just checked, and I see you removed the hidden field that is there to catch bots. I recommend you add that back in. I’ve explained them a bit more in the Contact Form Honeypots post.

Hi Wendy. I’m actually in the process of writing a small, free ebook to show how to extend the form like this. In the meantime, here are some basic guidelines.

In the form code, when duplicating the fields you already have, you need to make sure that each has a unique name=”“ value. (Also modify the for=”“ and id=”“ for each label/input pair so that they don’t conflict with those of other pairs.)

So Let’s say you end up with something like this:

<div>
<label for="phone">Telephone</label>
<input name="phone" type="text" id="phone" placeholder="your telephone number">
</div>

<div>
<label for="cname">Child’s Name</label>
<input name="cname" type="text" id="cname" placeholder="your child’s name">
</div>

<div>
<label for="year">School Year</label>
<input name="year" type="text" id="year" placeholder="current school year">
</div>

In the process.php file, you then need to add a few things. Firstly, after $nam = $_POST[“name”];, add these lines:

$pho = $_POST["phone"];
$cna = $_POST["cname"];
$yea = $_POST["year"];

Then, after this block of code:

if (empty($nam) || !preg_match("~^[a-z\-'\s]{1,60}$~i", $nam)) {
$error_msg[] = "The name field must contain only letters, spaces, dashes ( - ) and single quotes ( ' )";
}

add this:

if (empty($pho) || !preg_match("/^[A-z\/0-9\s\(\)]{1,60}$/", $pho)) {
$error_msg[]="The phone field can contain only digits, spaces and parentheses";
}

if (empty($cna) || !preg_match("~^[a-z\-'\s]{1,60}$~i", $cna)) {
$error_msg[] = "The Child’s Name field must contain only letters, spaces, dashes ( - ) and single quotes ( ' )";
}

if (empty($yea) || !preg_match("/^([[:digit:]])+$/", $yea)) {
$error_msg[]="The Year field must contain only digits without spaces";
}

I’m assuming above that each field will be required.

Below that, there’s the form that gets echoed if there’s an error. I’m sure you can update all that yourself by following the pattern of the other parts.

Finally, amend the $email_body section to this:

$email_body =
"Name of sender: $nam\n\n" .
"Email of sender: $ema\n\n" .
"Sender's Telephone: $pho\n\n" .
"Child's Name: $cna\n\n" .
"School Year: $yea\n\n" .
"COMMENTS:\n\n" .
"$com" ;

With any luck, that will do it!

Hi Mikey. Thanks for your comments.

I’m not sure that the HTML document wide ID value is allowed with the textarea tag in HTML5?

IDs are classed as “global attributes”—which means they can be placed on all HTML elements, so it’s certainly fine to include one here (desirable, in fact, because it associates the textarea with the label—thanks to the for attribute).

The list of HTML5 attributes you linked to are new ones for HTML5, but certainly not the only ones.

Hi Jen. The first thing I’d recommend is to look into “responsive web design”, for which there are many resources, such as the article I linked to, and various books and online courses and videos.

Hope that helps.

Hi Laura. Not really sure what you mean. It’s very hard to send spam via a form like this. The most someone can do is annoy you a bit, but there’s no security thread in that. What do you mean by ‘click back’? If you close the page or move to another one, the form inputs are cleared away.

If you mean that the user can click the back button and resubmit the form again and again, then that’s true. The internal version has a timer on it, though, which means the spammer would have to wait each time to be able to resubmit—and I doubt most spammers have that kind of patience. There’s only so much you can do to stop people annoying you, and in my experience, I’ve not seen someone submitting the same thing over and over, so I suspect it’s not common. There’s really nothing for a spammer to gain from it.

Hi Jen. You definitely can store form data in a database, or even just in a flat file. This is beyond the scope of this simple form, though. A good resource for learning about this sort of thing is Kevin Yank’s book PHP: Novice to Ninja.

Hi Dave. Sounds odd. The one circumstance where I’ve seen this happen is when you enter the same email address as the form data will be sent to. Try sending the form with a made up email address—or at least something different from the address to which the form data will be sent.

That’s great. Glad you found a solution, Dave!

Hi Kathy. Great question.

There are various things you can do. You could, for example, redirect to a static page on your site that informs the user that there was an error, perhaps with a list of things to watch for … although that’s not very helpful. You would do that by changing this section (starting line 52 in process.php)—

if ($error_msg) {
… current code for the error page …
exit();
}

to this

if ($error_msg) {
header ("Location: errorpage.html");
exit();
}

… where errorpage.html is the path to your error page.

However, in the process.php page from line 52, you see all the HTML code for the current error page. A nicer option is to replace the HTML parts with your current site’s HTML/CSS, so that you keep the current error page—with the user’s errors actually listed—along with your site’s own styles and layout. Just place this error code wherever you want in your template:

echo '<ul>';
foreach ($error_msg as $err) {
echo '<li>'.$err.'</li>';
}
echo '</ul>'

… and keep the class (class="err") on the ul if you need to.

Does that make sense?

Hi Adean. Did you modify the file in any way, other than adding in the appropriate email address etc? As noted in this explanation of PHP header errors,  the error message is telling you that the problem is on line 1 of the contact.php file, and it’s probably a case of there being some whitespace before the opening <?php, which is not allowed. Could you check that?

Hi Dave. I think you mean that GMail isn’t receiving the emails? They work fine in GMail for me, so it might be worth checking your spam folder. If they are being received at Yahoo, it sounds like the form code is working fine, and that something else is going on elsewhere. It may be worth adding SPF records and or DKIM authentication for your email account(s).

Thanks Dave. I have found it can be a problem to test the form by entering the same email address as the address the form data will be sent to. That shouldn’t necessitate changing the form code, thought. To test the form, just enter any email address other than your own—even a fake one. Not sure if that’s the situation you were facing, though.

Thanks for the feedback, Dave. Not totally sure what’s going on there, but glad you found a solution. I use Google Apps too and haven’t run into any issues.

Hi Dave. I guess that’s just how I felt on the day. They can be used for spam and code injections, so it’s really up to you what you do and don’t allow.

Hi Melissa. I can’t really say what might be going awry for what you’ve said, but I’d be happy to take a look if you like. Perhaps just get in contact directly.

Hi CSINIA. It’s actually quite easy to set up the form so that it can send to various recipients based on what’s selected in the form, but it’s a bit beyond the scope of this simple post. If you want, post your form code and indicate which part of it determines the email choice.

Hi CSINIA,

So, if people want to contact a certain individual …

The way I’ve done that in the past is to include a select list in the form (or you could use check boxes if you want multiple recipients) and then in the processing script take a look at who was selected and use the associated email address for that selection as the recipient of the email.

As a simple example, let’s say you add this to the form:

<label for="recipient">Choose a Recipient</label>
<select name="recipient" id="recipient">
<option value="Please Choose a Recipient"><?php if (isset($_POST['recipient'])) {print "$rec";} else {print "Please choose a REcipient";}?></option>
<option value="John">John</option>
<option value="Sarah">Sarah</option>
</select>

Then, in the PHP, something like this:

if (isset($_POST["recipient"])) {
$rec = $_POST["recipient"];
}

Then you establish the recipient:

if ($rec == "John") {
$your_email="[email protected]";
}
elseif ($rec == "Sarah") {
$your_email="[email protected]";
}
else {
$your_email="[email protected]";
}

Hi Dave. File uploading is a different animal altogether, and I’m not qualified to guide you on that. There are lots of online guides, though, including this one from the SitePoint forums. Sorry I couldn’t be more help, but personally I’m not too keen on allowing file uploads anyway (for security reasons etc.). I’d rather establish email contact with someone first and then perhaps share files via email.

Hi Ron. Thanks for your comments.

Yep, it’s quite straightforward to do that. You can just replace this line:

header ("Location: $thanks_page");

with something like this:

echo '<!DOCTYPE html>
<html>
<head>
<meta charset="utf-8">
<title>Thank You!</title>
</head>
<body>
<h1>Thanks for your comments!</hi>
<p>We\'ll get back to you as soon as possible.</p>
</body>
</html>';

Of course, you can make it a lot more sophisticated than that, including all the layout and styles you want, but this is the basic idea.