Modify php to Notify 2 People When User Submits Form?

A friend asked me to modify a php form on her website. Now, whenever a user submits the form, my friend gets an email showing what the user submitted.

She wants to continue receiving the email, and she wants her friend to also get a copy of it.

The code now is:

if($toComplete == '' && $_SERVER['REQUEST_METHOD'] == 'POST')
{
	mail("Sue@example.com", "Membership application" , $message , "from: $name <$email>");
}

Code (markup):

How can it be changed to email both people?

Thank you.

 

Um, just add another mail() after the first one, with Tom's email address instead of Sue's. Surely you could have figured that out.

P.S. Make sure you are aggressively cleaning $name and $email, otherwise spambots will find your script and use it to blast spams to everyone on the internet.

 

separate emails using a comma.

if($toComplete == '' && $_SERVER['REQUEST_METHOD'] == 'POST')
{
$to = 'email1@domain.com,email2@domain.com,email3@domain.com';
	mail($to, "Membership application" , $message , "from: $name <$email>");
}

PHP:

PS: Also, spam bots use actual valid email addresses, therefore a captcha/security code will help prevent spam.

 

Thank you, Dannywwww. I did not know if comma, semicolon, or something else was appropriate separator.

You overestimate my ability to figure out php

Earlier on the page, this line appears:

$oknameChars = "abcdefghijklmnopqrstuvwxyz.";

Code (markup):

Does that provide adequate protection?

 

I would say not, as i previously stated, spam bots use VALID emails, or valid formats of emails.

http://www.w3schools.com/php/php_secure_mail.asp

check that out, will help. Though, as I said, a complex captcha will help stop spam bots hitting your form.

 

Depends on what it does with those characters.

The loophole you're looking for is the ability to pass newline characters in name/email fields, because that can be used to create a new header to Cc: other recipients, then break out of the header and into the content part of the message.

If nothing is allowed except what's in $oknameChars that's okay, but it seems unlikely since most people have spaces in their names.

 

Very interesting observation, SmallPotatoes. The form does accept space characters in the name field, but space is not among the permitted characters.

This form is on a page of a large institution, with the creator long gone and nobody knows anything about it (including me).