我正在看一个php显示某些东西的问题

Question

I have just done a php contact form for my website, but what I get is this:

https://gyazo.com/2f3c4faa5bc253a6e3ff94d78214867d

And the code I'm using is this:

<?php
include('***Contains private stuff***.php');
//Send mail function
function send_mail($to,$subject,$message,$headers){
    return @mail($to,$subject,$message,$headers);
}

if($_POST) {

    $to = "***PRIVATE MAIL***"; // Your email here
    $subject = 'Message from my website'; // Subject message here

        //MySQL
        $query = "INSERT INTO contact (name, email, subject, message) VALUES ('$name', '$email', '$subject', '$message')";
        $result = mysqli_query($connection, $query);

        //Sanitize input data, remove all illegal characters
        $name    = filter_var($_POST['name'], FILTER_SANITIZE_STRING);
        $email    = filter_var($_POST['mail'], FILTER_SANITIZE_EMAIL);
        $subject = filter_var($_POST['subject'], FILTER_SANITIZE_STRING);
        $message = filter_var($_POST['message'], FILTER_SANITIZE_STRING);

        //Send Mail
        $headers = 'From: ' . $email .''. "
".
            'Reply-To: '.$email.'' . "
" .
            'X-Mailer: PHP/' . phpversion();


        $sent = send_mail($to, $subject, $message . "

"  .'Name: '.$name. "
" .'Email: '.$email, $headers);
        if (! $sent) {
            // log the error
            error_log('Mail Error: Message to ' . $to . ' wasn\'t sent');
        }
}
?>

And I just want to remove it, but can't really figure out the issue. Link to my friends website I'm using for the testing, and live view.

http://thomasmaneschijn.com/lukas/

And you should be able to see my html code on the site as well. Reason I marked the include section out is because there is some passwords and stuff that I don't want to leak.

Answer 1

You have few issues in your code:

Issue 1, Your code is wide open for SQL Injection, you must need to prevent your code with SQL Injection.

Issue 2, You are calling send_mail() without using any check, you need to move this inside the if($_POST) check, otherwise, it will execute on every page refresh.

Issue 3, Your INSERT query placement is wrong, from where you define these variables VALUES ('$name', '$email', '$subject', '$message') before this query?

According to your screen shot, you are getting json response just because of send_mail() method, if you move your code something like:

// Move `send_mail()` method here
if($_POST) {
// Your Variables
// Your Query / MYSQL / suggest you to use PDO here.
// Your method calling
}

Some helpful links:

How can I prevent SQL injection in PHP?

Are PDO prepared statements sufficient to prevent SQL injection?

Always use error_reporting() on local environment.