Quick script question

Question

Hi all,
Could anyone advise me if i can add anything within - header('Location: http://www.mysite.co.uk/thankyou.html'); in the script below so as the page
re- directs back to the main index page after a few seconds ?
Thankyou for any help.
<?php
$to = '[email protected]';
$subject = 'Feedback form results';
// prepare the message body
$message = '' . $_POST['Name'] . "\n";
$message .= '' . $_POST['E-mail'] . "\n";
$message .= '' . $_POST['Phone'] . "\n";
$message .= '' . $_POST['Message'];
// send the email
mail($to, $subject, $message, null, '');
header('Location: http://www.mysite.co.uk/thankyou.html');
?>

Answer 1

andy7719 wrote:
Mr powers gave me that script so im rather confused at this point in time
I don't think I "gave" you that script. I might have corrected a problem with it, but I certainly didn't write the original script.
What you're using is far from perfect, but to suggest it would lay you open to MySQL injection attacks is ludicrous. For you to be prone to MySQL injection, you would need to be entering the data into a MySQL database, not sending it by email.
There is a malicious attack known as email header injection, which is a serious problem with many PHP email processing scripts. However, to be prone to email header injection, you would need to use the fourth argument of mail() to insert form data into the email headers. Since your fourth argument is null, that danger doesn't exist.
One thing that might be worth doing is checking that the email address doesn't contain a lot of illegal characters, because that's a common feature of header injection attacks. This is how I would tidy up your script:
<?php
$suspect = '/Content-Type:|Bcc:|Cc:/i';
// send the message only if the E-mail field looks clean
if (preg_match($suspect, $_POST['E-mail'])) {
  header('Location: http://www.example.com/sorry.html');
  exit;
} else {
  $to = '[email protected]';
  $subject = 'Feedback form results';
  // prepare the message body
  $message = 'Name: ' . $_POST['Name'] . "\n";
  $message .= 'E-mail: ' . $_POST['E-mail'] . "\n";
  $message .= 'Phone: ' . $_POST['Phone'] . "\n";
  $message .= 'Message: ' . $_POST['Message'];
  // send the email
  mail($to, $subject, $message);
  header('Location: http://www.example.com/thankyou.html');
  exit;
?>
Create a new page called sorry.html, with a message along the lines of "Sorry, there was an error sending your message". Don't put anything about illegal attacks. Just be neutral.
By the way, when posting questions here, don't use meaningless subject lines, such as "Quick script question". If you're posting here, it's almost certain to be a question about a script. It doesn't matter whether it's quick. Use the subject line to tell people what it's about.