Problems with vaildation and PHP - php

Question

I am hoping that someone can help me with this PHP Script. It sends the email perfectly, although the validation doesn't work. This script is also not stripping HTML tags from the email when sent. This makes me worry that my sanitizeString function is not working properly and am open to xss. My user group will not have Java support...hence trying to use PHP.
Here is the PHP Code:
<?php
//Strip Tags and white Space from all input with this function
function sanitizeString($value){
$value = strip_tags($value);
$value = trim($value);
$value = escapeshellcmd($value);
$value = htmlentities($value);
return $value;
}
$send = $_POST[send];
//Email validation
if (filter_var($from, FILTER_VALIDATE_EMAIL)) {
$email_error = true;
$error_message[] = "Please use a valid email format: name#domain.com";
}
if($send == 1){$email_sent = true; $step_1 = "complete";}
else{$email_sent = false; $step_1 = "complete";}
if($email_sent === true) {
$from = sanitizeString($_POST['from']);
$to = sanitizeString($_POST['to']);
$name = sanitizeString($_POST['name']);
$title = sanitizeString($_POST['title']);
$company = sanitizeString($_POST['company']);
$phone = sanitizeString($_POST['phone']);
$subject = sanitizeString($_POST['subject']);
$message = sanitizeString($_POST['message']);
// define variables and initialize with empty values
$nameErr = $addressErr = $emailErr = $messageErr = $phoneErr = "";
$name = $address = $email = $message = $phone = "";
if ($_SERVER["REQUEST_METHOD"] == "POST") {
if (empty($_POST["name"])) {
$nameErr = "Please enter your name.";
}
else {
$name = $_POST["name"];
}
if (empty($_POST["email"])) {
$emailErr = "Please enter your email.";
}
else {
$email = $_POST["email"];
}
if (empty($_POST["phone"])) {
$phoneErr = "Please enter a phone number.";
}
else {
$phone = $_POST["phone"];
}
if (empty($_POST["message"])) {
$messageErr = "Cannot leave message box blank.";
}
else {
$message = $_POST["message"];
}
}
//select the correct to address - This hides my email addresses from the source. Would love a better solution if you have one...
switch ($to) {
case "1":
$to = "Contact1#example.com";
break;
case "2":
$to = "Contact2#example.com";
break;
default:
$to = "Contact1#example.com";
break;}
if($message_error !== true && $email_error !== true){
$email_headers = "From:".$from."\nMIME-Version: 1.0 \nContent-type: text/html; charset=iso-8859-1";
$message_send = "<h3>".$name."<br>".$title."<br>".$company."<br>".$phone."<br>".$from."</h3><hr><h4>".$subject."</h4>".$message;
if (mail($to, $subject, $message_send, $email_headers)) {$error_message = "Thank you, your email is on the way!";}
else {$error_message = "There seems to be a problem!";}}
}
?>
For simplicity and the fact that I don't need HTML support, which I seem to get with every post asking for PHP help, here are my input fields. Yes before you comment on the input fields, I use css and I will be placing them in the right area of the page. :) Not trying to be rude, just trying to prevent suggestions outside of the topic stated above...
<form action="<?php ($_SERVER["PHP_SELF"]);?>" method="post">
<input name="name" placeholder="Name*" type="text" class="text"/><span class="error"><?php echo $nameErr;?></span>
<input type="text" placeholder="Title" name="title" size="50"/>
<input type="text" placeholder="Company" name="company" size="50" />
<input name="phone" placeholder="Phone*" type="tel" size="10" maxlength="10" value="<?php echo htmlspecialchars($phone);?>"/><span class="error" style="color:#990000"><?php echo $phoneErr;?></span>
<input name="from" placeholder="Email*" type="email" class="text" value="<?php echo htmlspecialchars($email);?>"><span class="error"><?php echo $emailErr;?>
<select name="to" size="1">
<option value="1">Contact1</option>
<option value="2">Contact2</option>
</select>
<input type="text" name="subject" placeholder="Subject" size="50" />
<textarea cols="50" rows="4" name="message" placeholder="Type your message here."></textarea>
<input type="hidden" name="send" value="1" /><input type="submit" value="Send" name="email_1" />
</form>

Answer 1

You are sanitizing here:
//note, moved the setting to "" before sanitizing
// define variables and initialize with empty values
$nameErr = $addressErr = $emailErr = $messageErr = $phoneErr = "";
$name = $address = $email = $message = $phone = "";
$from = sanitizeString($_POST['from']);
$to = sanitizeString($_POST['to']);
$name = sanitizeString($_POST['name']);
$title = sanitizeString($_POST['title']);
$company = sanitizeString($_POST['company']);
$phone = sanitizeString($_POST['phone']);
$subject = sanitizeString($_POST['subject']);
$message = sanitizeString($_POST['message']);
But then just assigning the variables here to the $_POST (not to the sanitized variable):
if ($_SERVER["REQUEST_METHOD"] == "POST") {
if (empty($_POST["name"])) {
$nameErr = "Please enter your name.";
}
else { // the else is not necessary; $name is already assigned if not empty.
$name = $_POST["name"];
}
if (empty($_POST["email"])) {
$emailErr = "Please enter your email.";
}
else { // the else is not necessary; $email is already assigned if not empty.
$email = $_POST["email"];
}
...
etc...
Change the last bit to reference your sanitized variables, like:
if ($_SERVER["REQUEST_METHOD"] == "POST") {
if (empty($name)) { // replaced $_POST['name'] with just $name
$nameErr = "Please enter your name.";
}
if (empty($email)) { // replaced $_POST['email'] with just $email
$emailErr = "Please enter your email.";
}
...
etc...
Edit- Update
To make sure the form was submitted, you should check your "submit" button.
(I would change the name from email_1 to submitted, for clarity).
So that in your HTML you have a submit button:
<input type="submit" name="submitted" value="true" >
Then, add something like this to your validation code:
if (!isset($_POST['submitted'])){
$formErr ="The form was not submitted";
exit(); // this line is optional to the line above it
}
The validation literally says: "If the submitted field is not set, then throw an error";