how to send multipart/alternative email with PHP correctly - php

I'm trying to use the built-in PHP mail function to send multipart messages that contain a html and a plain text version of my message. I've been playing around with different encoding types but, I keep running into problems. Originally I set Content-Transfer-Encoding to Binary but, that resulted in exclamation points being placed every 78 characters. I also tried base64 but I believe that base64 is overkill for what I am doing.
All I'm doing is sending basic HTML, no encoded images, files, or attachments. I'd prefer an encoding method that would still allow the source code to be human readable.
I heard that Quoted-Printable is what I'm looking for but, when I attempted to send messages using that encoding type the result ending up looking really weird. I noticed a bunch of " symbols sprinkled throughout the message source code.
Here is the code I'm using:
$to = "to#test.com";
$subject = "test subject";
$boundary = uniqid('np');
$headers = "MIME-Version: 1.0\r\n";
$headers .= "From: from-address#test.com\r\n";
$headers .= "Reply-To: reply-address#test.com\r\n";
$headers .= "Return-Path: return-path#test.com\r\n";
$headers .= "Content-Type: multipart/alternative;boundary=" . $boundary . "\r\n";
$message = "This is a MIME encoded message.";
$message .= "\r\n\r\n--" . $boundary . "\r\n";
$message .= "Content-Type: text/plain; charset=UTF-8\r\n";
$message .= "Content-Transfer-Encoding: Quoted-Printable\r\n";
$message .= $plainTextMessage;
$message .= "\r\n\r\n--" . $boundary . "\r\n";
$message .= "Content-Type: text/html; charset=UTF-8\r\n";
$message .= "Content-Transfer-Encoding: Quoted-Printable\r\n";
$message .= $HTMLmessage;
$message .= "\r\n\r\n--" . $boundary . "--";
$ok = mail($to,$subject,$message,$headers);
What the heck am I doing wrong here?

Hi try the following code,
$to = "to#test.com";
$subject = "test subject";
$plainTextMessage = "Hi all";
$HTMLmessage = "<b>Hi all</b>";
//$boundary = uniqid('np');
$boundary = md5(uniqid(time()));
$headers .= "From: from-address#test.com\r\n";
$headers .= "Reply-To: reply-address#test.com\r\n";
$headers .= "Return-Path: return-path#test.com\r\n";
$headers .= "Content-Type: multipart/alternative;boundary=" . $boundary . "\r\n";
$message = "This is a MIME encoded message.";
$message .= "\r\n\r\n--" . $boundary . "\r\n";
$message .= "Content-Type: text/plain; charset=UTF-8\r\n";
$message .= "Content-Transfer-Encoding: Quoted-Printable\r\n";
$message .= $plainTextMessage;
$message .= "\r\n\r\n--" . $boundary . "\r\n";
$message .= "Content-Type: text/html; charset=UTF-8\r\n";
$message .= "Content-Transfer-Encoding: Quoted-Printable\r\n";
$message .= $HTMLmessage;
$message .= "\r\n\r\n--" . $boundary . "--";
$ok = mail($to,$subject,$message,$headers);
May it will help

No need for a third party library or an external mail forwarding host. This is what I use and it works like a charm. It also fixes some potential security holes by forcing headers using the $from address that can otherwise reveal your system user :
private function sendMail($to, $from, $fromName, $subject, $text, $html)
{
$boundary = uniqid('np');
$headers = "MIME-Version: 1.0\r\n";
$headers .= "From: ".$fromName." <".$from.">" . "\r\n";
$headers .= "X-Sender: ".$fromName." <".$from.">\n";
$headers .= "Return-Path: <".$from.">\n";
$headers .= "To: ".$to."\r\n";
$headers .= "Content-Type: multipart/alternative;boundary=" . $boundary . "\r\n";
// Content body
$message = "This is a MIME encoded message.";
$message .= "\r\n\r\n--" . $boundary . "\r\n";
$message .= "Content-type: text/plain;charset=utf-8\r\n\r\n";
// Plain text body
$message .= $text;
$message .= "\r\n\r\n--" . $boundary . "\r\n";
$message .= "Content-type: text/html;charset=utf-8\r\n\r\n";
// Html body
$message .= $html;
$message .= "\r\n\r\n--" . $boundary . "--";
// Send mail
mail('', $subject, $message, $headers, '-f ' . $from);
}

Related

Send HTML email with attachment using PHP mail() [duplicate]

Suddenly have started receiving the above error without any changes having been made to the script.
Host is 1and1 (I know...)
The script still works fine on a different server, and so my suspicion is that there must have been some server config change that has lead to this, although the hosts plead ignorance.
There's no information on the above error at all in Google that I can find - does anybody have any ideas? Server is running Apache if that helps.
Had just the similar problem.
It came out of the blue. No PHP Code was changed.
What was changed: PHP was upgraded 5.5.25-1 to 5.5.26.
A security risk in PHP mail() function has been fixed and extra newlines in additional_headers are allowed no more. Because extra newlines mean: now starts the email message (and we surely don't want somebody to inject some newlines through headers followed by an evil message).
What previously have worked fine, e.g. just having extra newlines after headers or even passing the whole message to additional_headers, will function no more.
Solution:
Sanitize your headers. No multiple newlines in additional_headers argument. These count as "multiple or malformed newlines": \r\r, \r\0, \r\n\r\n, \n\n, \n\0.
Use additional_headers for headers only. Email message (multipart or not, with ir without attachments, etc) belongs in message argument, not in headers.
PHP Security Bug report: https://bugs.php.net/bug.php?id=68776
C Code diff how its fixed: http://git.php.net/?p=php-src.git;a=blobdiff;f=ext/standard/mail.c;h=448013a472a3466245e64b1cb37a9d1b0f7c007e;hp=1ebc8fecb7ef4c266a341cdc701f0686d6482242;hb=9d168b863e007c4e15ebe4d2eecabdf8b0582e30;hpb=eee8b6c33fc968ef8c496db8fb54e8c9d9d5a8f9
None of the above answers solved this problem for me. So, I expanded my search to "mail with attachment and HTML message issues." Piecing together info from a few different posts, I came up with this. It allows for BOTH HTML email and an attachment.
My original header code:
$header = "From: ".$from_name." <".$from_mail.">\r\n";
$header .= "Reply-To: ".$replyto."\r\n";
$header .= "MIME-Version: 1.0\r\n";
$header .= "Content-Type: multipart/mixed; boundary=\"".$uid."\"\r\n";
$header .= "--".$uid."\r\n";
$header .= "Content-Type: text/html; charset=ISO-8859-1\r\n";
$header .= "Content-Transfer-Encoding: 8bit\r\n";
$header .= $body."\r\n";
$header .= "--".$uid."\r\n";
$header .= "Content-Type: application/pdf; name=\"".$filename."\"\r\n";
$header .= "Content-Transfer-Encoding: base64\r\n";
$header .= "Content-Disposition: attachment; filename=\"".$filename."\"\r\n";
$header .= $content."\r\n";
$header .= "--".$uid."--";
if (mail($mail_to, $subject, "", $header))
{
return "mail_success";
}
else
{
return "mail_error";
}
My new code (complete):
Note that $body is the HTML that is being assembled by a different function.
$file = $path.$filename;
$file_size = filesize($file);
$handle = fopen($file, "r");
$content = fread($handle, $file_size);
fclose($handle);
$content = chunk_split(base64_encode($content));
$uid = md5(uniqid(time()));
$name = basename($file);
$eol = PHP_EOL;
// Basic headers
$header = "From: ".$from_name." <".$from_mail.">".$eol;
$header .= "Reply-To: ".$replyto.$eol;
$header .= "MIME-Version: 1.0\r\n";
$header .= "Content-Type: multipart/mixed; boundary=\"".$uid."\"";
// Put everything else in $message
$message = "--".$uid.$eol;
$message .= "Content-Type: text/html; charset=ISO-8859-1".$eol;
$message .= "Content-Transfer-Encoding: 8bit".$eol.$eol;
$message .= $body.$eol;
$message .= "--".$uid.$eol;
$message .= "Content-Type: application/pdf; name=\"".$filename."\"".$eol;
$message .= "Content-Transfer-Encoding: base64".$eol;
$message .= "Content-Disposition: attachment; filename=\"".$filename."\"".$eol;
$message .= $content.$eol;
$message .= "--".$uid."--";
if (mail($mail_to, $subject, $message, $header))
{
return "mail_success";
}
else
{
return "mail_error";
}
Two key changes here. (1) removed all the multi-part stuff from the headers into $message. (2) removed all the "\r\n" stuff and added $eol = PHP_EOL; to the code.
Together, these changes allowed me to once again send HTML email with attachments.
Had the same problem:
Removed the mime boundary and message from the header and all worked.
$header = "From: ".$from_name." <".$from_mail.">\n";
$header .= "Reply-To: ".$replyto."\n";
$header .= "MIME-Version: 1.0\n";
$header .= "Content-Type: multipart/mixed; boundary=\"".$uid."\"\n\n";
$emessage= "--".$uid."\n";
$emessage.= "Content-type:text/plain; charset=iso-8859-1\n";
$emessage.= "Content-Transfer-Encoding: 7bit\n\n";
$emessage .= $message."\n\n";
$emessage.= "--".$uid."\n";
$emessage .= "Content-Type: application/octet-stream; name=\"".$filename."\"\n"; // use different content types here
$emessage .= "Content-Transfer-Encoding: base64\n";
$emessage .= "Content-Disposition: attachment; filename=\"".$filename."\"\n\n";
$emessage .= $content."\n\n";
$emessage .= "--".$uid."--";
mail($mailto,$subject,$emessage,$header);
None of the above fixed it for me - main issue is you must not put anything other than header definitions in headers. Old scripts bunged anything in there. So move any text or attachments that were stuffed in to headers into the message body. Makes sense..
This has an explanation
(I guess it's same solution as Frank's above plus Davisca's "no double new lines" - but you need doubled new lines for attachments)
This will solve your problem. I have changed a little bit of Frank's code. This code will support attachment and html.
<?php
$filename = "certificate.jpg";
$path = "/home/omnibl/subdomains/test/certificate/certimage/";
$file = $path . $filename;
$file_size = filesize($file);
$handle = fopen($file, "r");
$content = fread($handle, $file_size);
fclose($handle);
$content = chunk_split(base64_encode($content));
$uid = md5(uniqid(time()));
$name = basename($file);
$eol = PHP_EOL;
$subject = "Mail Out Certificate";
$message = '<h1>Hi i m mashpy</h1>';
$from_name = "mail#example.com";
$from_mail = "mail#example.com";
$replyto = "mail#example.com";
$mailto = "mail#example.com";
$header = "From: " . $from_name . " <" . $from_mail . ">\n";
$header .= "Reply-To: " . $replyto . "\n";
$header .= "MIME-Version: 1.0\n";
$header .= "Content-Type: multipart/mixed; boundary=\"" . $uid . "\"\n\n";
$emessage = "--" . $uid . "\n";
$emessage .= "Content-type:text/html; charset=iso-8859-1\n";
$emessage .= "Content-Transfer-Encoding: 7bit\n\n";
$emessage .= $message . "\n\n";
$emessage .= "--" . $uid . "\n";
$emessage .= "Content-Type: application/octet-stream; name=\"" . $filename . "\"\n"; // use different content types here
$emessage .= "Content-Transfer-Encoding: base64\n";
$emessage .= "Content-Disposition: attachment; filename=\"" . $filename . "\"\n\n";
$emessage .= $content . "\n\n";
$emessage .= "--" . $uid . "--";
mail($mailto, $subject, $emessage, $header);
Another scenario that brings the same new error is if you are not sending any headers to the "mail" command. It used to just use a default, and now gives the misleading error: "Multiple or malformed newlines found in additional_header".
Can be fixed by adding this:
$header = "From: ".$from_name." <".$from_mail.">\n";
$header .= "Reply-To: ".$replyto."\n";
$header .= "MIME-Version: 1.0\n";
...
mail($mailto,$subject,$emessage,$header);
my PHP version - 5.4.43,
probably contains Fixed bug #68776.
googling to the same error showed [http://fossies.org/diffs/php/5.4.42_vs_5.4.43/ext/standard/mail.c-diff.html]
=> I cannot use empty strings as mail() parameters.
my old code:
$headers = 'From: ' . $frm . "\r\n";
$headers .= 'To: ' . $contactEmail . "\r\n";
if ( $flag ) {
$headers .= 'To: ' . $contactEmail2 . "\r\n";
}
$headers .= 'Cc: ' . $contactEmailCc . "\r\n";
$headers .= 'Bcc: ' . $contactEmailBcc . "\r\n";
$headers .= 'Return-Path: ' . $frm . "\r\n";
$headers .= 'MIME-Version: 1.0' ."\r\n";
$headers .= 'Content-Type: text/HTML; charset=ISO-8859-1' . "\r\n";
$headers .= 'Content-Transfer-Encoding: 8bit'. "\n\r\n";
$headers .= $htmlText . "\r\n";
if (!mail('', $strSubject, '', $headers)) { // !!! note the empty parameters.
my new code:
$headers = 'From: ' . $frm . "\r\n";
// note: no "To: " !!!
$headers .= 'Cc: ' . $contactEmailCc . "\r\n";
$headers .= 'Bcc: ' . $contactEmailBcc . "\r\n";
$headers .= 'Return-Path: ' . $frm . "\r\n";
$headers .= 'MIME-Version: 1.0' ."\r\n";
$headers .= 'Content-Type: text/HTML; charset=ISO-8859-1' . "\r\n";
$headers .= 'Content-Transfer-Encoding: 8bit'. "\n\r\n";
// note: no $htmlText !!!
// note: new parameters:
$mTo = $contactEmail;
if ( $flag ) {
$mTo .= ', ' . $contactEmail2;
}
$mMessage .= $htmlText . "\r\n";
if (!mail($mTo, $strSubject, $mMessage, $headers)) {
You may be running into Bug #69874 Can't set empty additional_headers for mail() if you haven't done anything stupid (i.e. forgot to sanitize the headers).
Test for the bug
$ php -d display_errors=1 -d display_startup_errors=1 -d error_reporting=30719 -r 'mail("test#email.com","Subject Here", "Message Here",NULL);'
Warning: mail(): Multiple or malformed newlines found in additional_header in Command line code on line 1
Alternately if you know your PHP version (hint: php -v) you can check the changelog for the bug number (69874) to see whether the fix has been applied for your version.
A short-term fix is to replace calls to mail() like this
function fix_mail( $to , $subject , $message , $additional_headers =NULL, $additional_parameters=NULL ) {
$to=filter_var($to, FILTER_SANITIZE_STRING, FILTER_FLAG_NO_ENCODE_QUOTES| FILTER_FLAG_STRIP_LOW| FILTER_FLAG_STRIP_HIGH);
$subject=filter_var($subject, FILTER_SANITIZE_STRING, FILTER_FLAG_NO_ENCODE_QUOTES| FILTER_FLAG_STRIP_LOW| FILTER_FLAG_STRIP_HIGH);
if (!$additional_headers)
return mail( $to , $subject , $message );
if (!$additional_parameters)
return mail( $to , $subject , $message , $additional_headers );
return mail( $to , $subject , $message , $additional_headers, $additional_parameters );
}
Incase this helps anyone, I am using PHP 5.6 and an old code igniter v1 email library
email.php: line 1510 - I've added this:
$this->_header_str = str_replace("\r\r","",$this->_header_str);
$this->_header_str = str_replace("\r\0","",$this->_header_str);
$this->_header_str = str_replace("\r\n\r\n","",$this->_header_str);
$this->_header_str = str_replace("\n\n","",$this->_header_str);
$this->_header_str = str_replace("\n\0","",$this->_header_str);
above this line:
if ( ! mail($this->_recipients, $this->_subject, $this->_finalbody, $this->_header_str, "-f ".$this->clean_email($this->_headers['Return-Path'])))
return FALSE;
else
return TRUE;
And that is successfully sanitising the email headers and resolving the error that I was receiving (same as the original poster of this question)
This is quite possibly someone trying to take advantage of your code to inject email headers.
http://resources.infosecinstitute.com/email-injection/
I would suggest you examine access logs etc and look for unusual activity. The fact you are getting error messages hopefully means that your script has not been compromised and it is erroring out instead. You need to make sure though.

Sending multipart email from php, only download shows not the actual message

I'm struggling with sending my multipart email with plain text version as well as with HTML. Unfortunately when I receive it in Gmail it shows as downloadable message only as shown below:
The code is pasted below and although I went over like 100 questions here on SO I'm still stuck.
$headers = "MIME-Version: 1.0\r\n";
$headers .= "From: donotreply#someaddress.com\r\n";
$headers .= "Subject: Test mail\r\n";
$headers .= "Content-Type: multipart/alternative;boundary=" . $boundary . "\r\n";
$message = "This is a MIME encoded message.";
$message .= "\r\n\r\n--" . $boundary . "\r\n";
$message .= "Content-type: text/plain;charset=utf-8\r\n\r\n";
// plain text version
$message .= $plainTextMessage;
$message .= "\r\n\r\n--" . $boundary . "\r\n";
$message .= "Content-type: text/html;charset=utf-8\r\n\r\n";
// html version here
$message .= $htmlMessage;
$message .= "\r\n\r\n--" . $boundary . "--";
return #mail($to, $subject, $message, $headers);

Plain text version of email is not working

So I have the script sending a multipart email of plain text and html, some reason the plaintext version is not working, but I can see that it is sending when I show original in gmail. It just shows the html though when I click message garbled?
// headers
$headers = "MIME-Version: 1.0\r\n";
$headers .= 'From: From Name <'. FROM_EMAIL. ">\r\n";
$headers .= 'To: '.$member->member_info['memem']. "\r\n";
$headers .= 'Bcc: receipts#gmail.com' . "\r\n";
$headers .= "Subject: Registration Receipt\r\n";
$headers .= "Content-Type: multipart/alternative;boundary=" . $boundary . "\r\n";
// Additional headers
$message . "\r\n\r\n--" . $boundary . "\r\n";
$message .= "Content-type: text/plain;charset=utf-8\r\n\r\n";
$message .= $receipt_txt;//plain text
$message .= "\r\n\r\n--" . $boundary . "\r\n";
$message .= "Content-type: text/html;charset=utf-8\r\n\r\n";
$message .= $receipt_html;//html
$message .= "\r\n\r\n--" . $boundary . "--";
mail( $member->member_info['memem'], 'Registration Receipt', $message, $headers );
Crap. I found it. "$message . "\r\n\r\n--" . $boundary . "\r\n";" should be "$message .= "\r\n\r\n--" . $boundary . "\r\n";" I feel dumb :(

PHP Sendmail sender name is always Apache when header have attachment

We are trying to send an email using sendmail. Everything works fine with normall headers but the moment we add attachment in the header, the sender name comes as Apache. Here is our code snippet
$from_email = "noreply#domain.com";
$separator = md5(time());
$eol = PHP_EOL;
$filename = "attachment.pdf";
$attachment = chunk_split(base64_encode(file_get_contents($filename)));
$text = "Hi!";
// main header (multipart mandatory)
$headers = "From:".$from_email.$eol;
$headers = "Bcc:user#domain.com".$eol;
$headers .= "MIME-Version: 1.0".$eol;
$headers .= "Content-Type: multipart/mixed; boundary=\"".$separator."\"".$eol.$eol;
$headers .= "Content-Transfer-Encoding: 7bit".$eol;
$headers .= "This is a MIME encoded message.".$eol.$eol;
// message
$message .= "--".$separator.$eol;
$message .= "Content-Type: text/html; charset=\"iso-8859-1\"".$eol;
$message .= "Content-Transfer-Encoding: 8bit".$eol.$eol;
$message .= $text.$eol.$eol;
// attachment
$message .= "--".$separator.$eol;
$message .= "Content-Type: application/pdf".$eol;
$message .= "Content-Transfer-Encoding: base64".$eol;
$message .= "Content-Disposition: attachment; filename=\"".$filename."\"".$eol;
$message .= $attachment.$eol;
$message .= "--".$separator."--".$eol;
$b = mail($email, "Your Issue of the STQ",$message, $headers, "-fnoreply#domain.com");
By Adding -fnoreply#domain.com, we are getting like this in email header From: noreply#domain.com (Apache). Not sure where this Apache is coming from?
What could be the problem here.
Thanks
You need a dot on the second line.
$headers = "From:".$from_email.$eol;
$headers .= "Bcc:user#domain.com".$eol;
Make the header like this :
$headers .= 'From: <webmaster#example.com>' . "\r\n";
Also missing the dot on the second line as xyzz pointed

PHP mail with attachment - extra file: part 1.4

I'm using the following code to send an email with attachments:
$mime_boundary = "<<<--==+X[".md5(time())."]";
$headers .= "MIME-Version: 1.0\r\n";
$headers .= "Content-Type: multipart/mixed;\r\n";
$headers .= " boundary=\"".$mime_boundary."\"";
$message .= "This is a multi-part message in MIME format.\r\n\r\n";
$message .= "--".$mime_boundary."\r\n";
$message .= "Content-Type: text/plain; charset=\"iso-8859-1\"\r\n";
$message .= "Content-Transfer-Encoding: 7bit\r\n";
$message .= "\r\n";
$message .= "$message_body\r\n";
$message .= "--".$mime_boundary."\r\n";
foreach($attachments as $filename => $data)
{
$message .= "Content-Type: application/octet-stream;\r\n";
$message .= " name=\"$filename\"\r\n";
$message .= "Content-Transfer-Encoding: quoted-printable\r\n";
$message .= "Content-Disposition: attachment;\r\n";
$message .= " filename=\"$filename\"\r\n";
$message .= "\r\n";
$message .= chunk_split(base64_encode($data));
$message .= "\r\n";
$message .= "--".$mime_boundary."\r\n";
}
mail($email_address, $email_subject, $message, $headers);
Which works fine, except that an extra file is also attached (called "Part 1.4").
Is there a way to not have this added?
Cheers,
Dan.
IIRC the last part separator must be --something unique--, i.e. in your case
$message .= "--".$mime_boundary."--\r\n";
But mime mail is more or less a solved problem ( i.e. for an application developer it's boring when done correctly and reeeeally annoying when done wrong ;-) ). Do yourself a favor and use something like Swiftmailer or any other descend mailing library/class.

Categories