未发送 PHP 邮件图像附件

Question

Just to be clear - I didn't write this code, this is from a previous developer. Anyway, my client isn't receiving images when uploaded via their form, just a red box with an error message.

As per request here is the whole code:

<?php

function sendMail() {
  if (!isset ($_POST['to_email'])) { //Oops, forgot your email addy!
    die ("<p>Oops!  You forgot to fill out the email address! Click on the back arrow to go back</p>");
  }
  else {
    $to_name = stripslashes($_POST['to_name']);
    $from_name = stripslashes($_POST['from_name']);
    $from_telephone = stripslashes($_POST['from_telephone']);
    $subject = stripslashes($_POST['subject']);
    $body = stripslashes($_POST['body']);
    $address = stripslashes($_POST['address']);
    $to_email = $_POST['to_email'];
    $attachment = $_FILES['attachment']['tmp_name'];
    $attachment_name = $_FILES['attachment']['name']; 
    if (is_uploaded_file($attachment)) { //Do we have a file uploaded?
      $fp = fopen($attachment, "rb"); //Open it
      $data = fread($fp, filesize($attachment)); //Read it
      $data = chunk_split(base64_encode($data)); //Chunk it up and encode it as base64 so it can emailed
      fclose($fp);
    }
    //Let's start our headers
    $headers = "From: $from_name<" . $_POST['from_email'] . ">\n";
    $headers .= "Reply-To: <" . $_POST['from_email'] . ">\n"; 
    $headers .= "MIME-Version: 1.0\n";
    $headers .= "Content-Type: multipart/related; type=\"multipart/alternative\"; boundary=\"----=MIME_BOUNDRY_main_message\"\n"; 
    $headers .= "X-Sender: $from_name<" . $_POST['from_email'] . ">\n";
    $headers .= "X-Mailer: PHP4\n";
    $headers .= "X-Priority: 3\n"; //1 = Urgent, 3 = Normal
    $headers .= "Return-Path: <" . $_POST['from_email'] . ">\n"; 
    $headers .= "This is a multi-part message in MIME format.\n";
    $headers .= "------=MIME_BOUNDRY_main_message \n"; 
    $headers .= "Content-Type: multipart/alternative; boundary=\"----=MIME_BOUNDRY_message_parts\"\n"; 

    $message = "------=MIME_BOUNDRY_message_parts\n";
    $message .= "Content-Type: text/plain; charset=\"iso-8859-1\"\n"; 
    $message .= "Content-Transfer-Encoding: quoted-printable\n"; 
    $message .= "\n"; 
    /* Add our message, in this case it's plain text.  You could also add HTML by changing the Content-Type to text/html */
    $message .= "Return call on: $from_telephone\n\n";
    $message .= "$address\n\n";
    $message .= "$body\n";
    $message .= "\n"; 
    $message .= "------=MIME_BOUNDRY_message_parts--\n"; 
    $message .= "\n"; 
    $message .= "------=MIME_BOUNDRY_main_message\n"; 
    $message .= "Content-Type: application/octet-stream;\n\tname=\"" . $attachment_name . "\"\n";
    $message .= "Content-Transfer-Encoding: base64\n";
    $message .= "Content-Disposition: attachment;\n\tfilename=\"" . $attachment_name . "\"\n\n";
    $message .= $data; //The base64 encoded message
    $message .= "\n"; 
    $message .= "------=MIME_BOUNDRY_main_message--\n"; 

    // send the message
    mail("$to_name<$to_email>", $subject, $message, $headers); 
    print "<p align=\"center\">Thank you for your email.</p>";
  }
}

switch ($action) {
  case "send":
    showForm();
    sendMail();
    break;
  default:
    showForm();
}

?>

I'm completely confused by this code as I didn't write it and can't decrypt why "$attachment" and "$attachment_name" are separate strings, if I change the "attachment_name" to "attachment" will my problems be fixed?

Answer 1

The code that you have seems to work for me, but there are a few potential problems. I think perhaps the most important one is that the image is sent using an incorrect Content-Type: , but there are also some other issues detailed below.

Image type

$message .= "Content-Type: application/octet-stream;\\n\\tname=\\"" . $attachment_name . "\\"\\n";

The application/octet-stream is used as a last resort for sending arbitrary binary data when there is no appropriate content type, or the content type is unknown. You should use a proper image type:

$message .= "Content-Type: " . $_FILES['attachement']['type']
            . ";\n\tname=\"" . $attachment_name . "\"\n";

If you want to prevent users from mailing arbitrary files, you can use a white-list:

if (is_uploaded_file($attachment) &&
    ) {
  $fp = fopen($attachment, "rb"); //Open it
  $data = fread($fp, filesize($attachment)); //Read it
  $data = chunk_split(base64_encode($data)); //Chunk it up and encode it as base64 so it can emailed
  fclose ($fp); 
} else {
  echo "<p>Useful error message\n";
  exit;
}

MIME syntax

$headers .= "X-Priority: 3\\n"; //1 = Urgent, 3 = Normal $headers .= "Return-Path: <" . $_POST['from_email'] . ">\\n"; $headers .= "This is a multi-part message in MIME format.\\n";

The Return-Path: is the last of your headers. The next line is part of the message body . You need a blank line to separate the message body from the headers. Eg:

$headers .= "Return-Path: <" . $_POST['from_email'] . ">\n"; 

$headers .= "This is a multi-part message in MIME format.\n";

Personally, I would add the message body to $message instead. The mail() function doesn't care, it just concatenates the headers and message with a line break. See more about line endings below.

---

 $headers .= "------=MIME_BOUNDRY_main_message \\n"; $headers .= "Content-Type: multipart/alternative; boundary=\\"----=MIME_BOUNDRY_message_parts\\"\\n"; $message = "------=MIME_BOUNDRY_message_parts\\n";

Note that if you do move some of the lines above to $message , you need to insert an extra line break after the Content-Type: header.

---

 $attachment = $_FILES['attachment']['tmp_name']; $attachment_name = $_FILES['attachment']['name']; ... $message .= "Content-Disposition: attachment;\\n\\tfilename=\\"" . $attachment_name . "\\"\\n\\n";

$attachment_name is sent by the browser and is typically the original name of the file uploaded by the user. $attachment is the name of the temporary file where the image is stored on the server . The two are entirely different and are not interchangeable.

You may want to strip control characters (such as line breaks) and double quotes from these variables to prevent malicious users from disrupting the syntax of the headers.

Line endings

According to the Mail syntax , lines should be terminated with a CRLF ( "\\r\\n" ) sequence, but it is not clear which line ending should be used when calling the mail() function. The PHP documentation says:

If messages are not received, try using a LF ( \\n ) only. Some Unix mail transfer agents (most notably » qmail ) replace LF by CRLF automatically (which leads to doubling CR if CRLF is used). This should be a last resort, as it does not comply with » RFC 2822 .

$_POST[] data

You should not use raw data from $_POST[] in your mail headers. A malicious user could easily insert their own headers (such as Bcc: ) to send spam to arbitrary addresses. You should at least filter out control characters (such as line breaks) and perhaps also filter or escape angle brackets and double quotes depending on usage.