Suddenly have started receiving the above error without any changes having been made to the script.
Host is 1and1 (I know...)
The script still works fine on a different server, and so my suspicion is that there must have been some server config change that has lead to this, although the hosts plead ignorance.
There's no information on the above error at all in Google that I can find - does anybody have any ideas? Server is running Apache if that helps.
Had just the similar problem.
It came out of the blue. No PHP Code was changed.
What was changed: PHP was upgraded 5.5.25-1 to 5.5.26.
A security risk in PHP mail() function has been fixed and extra newlines in additional_headers are allowed no more. Because extra newlines mean: now starts the email message (and we surely don't want somebody to inject some newlines through headers followed by an evil message).
What previously have worked fine, e.g. just having extra newlines after headers or even passing the whole message to additional_headers, will function no more.
Solution:
Sanitize your headers. No multiple newlines in additional_headers argument. These count as "multiple or malformed newlines": \r\r, \r\0, \r\n\r\n, \n\n, \n\0.
Use additional_headers for headers only. Email message (multipart or not, with ir without attachments, etc) belongs in message argument, not in headers.
PHP Security Bug report: https://bugs.php.net/bug.php?id=68776
C Code diff how its fixed: http://git.php.net/?p=php-src.git;a=blobdiff;f=ext/standard/mail.c;h=448013a472a3466245e64b1cb37a9d1b0f7c007e;hp=1ebc8fecb7ef4c266a341cdc701f0686d6482242;hb=9d168b863e007c4e15ebe4d2eecabdf8b0582e30;hpb=eee8b6c33fc968ef8c496db8fb54e8c9d9d5a8f9
None of the above answers solved this problem for me. So, I expanded my search to "mail with attachment and HTML message issues." Piecing together info from a few different posts, I came up with this. It allows for BOTH HTML email and an attachment.
My original header code:
$header = "From: ".$from_name." <".$from_mail.">\r\n";
$header .= "Reply-To: ".$replyto."\r\n";
$header .= "MIME-Version: 1.0\r\n";
$header .= "Content-Type: multipart/mixed; boundary=\"".$uid."\"\r\n";
$header .= "--".$uid."\r\n";
$header .= "Content-Type: text/html; charset=ISO-8859-1\r\n";
$header .= "Content-Transfer-Encoding: 8bit\r\n";
$header .= $body."\r\n";
$header .= "--".$uid."\r\n";
$header .= "Content-Type: application/pdf; name=\"".$filename."\"\r\n";
$header .= "Content-Transfer-Encoding: base64\r\n";
$header .= "Content-Disposition: attachment; filename=\"".$filename."\"\r\n";
$header .= $content."\r\n";
$header .= "--".$uid."--";
if (mail($mail_to, $subject, "", $header))
{
return "mail_success";
}
else
{
return "mail_error";
}
My new code (complete):
Note that $body is the HTML that is being assembled by a different function.
$file = $path.$filename;
$file_size = filesize($file);
$handle = fopen($file, "r");
$content = fread($handle, $file_size);
fclose($handle);
$content = chunk_split(base64_encode($content));
$uid = md5(uniqid(time()));
$name = basename($file);
$eol = PHP_EOL;
// Basic headers
$header = "From: ".$from_name." <".$from_mail.">".$eol;
$header .= "Reply-To: ".$replyto.$eol;
$header .= "MIME-Version: 1.0\r\n";
$header .= "Content-Type: multipart/mixed; boundary=\"".$uid."\"";
// Put everything else in $message
$message = "--".$uid.$eol;
$message .= "Content-Type: text/html; charset=ISO-8859-1".$eol;
$message .= "Content-Transfer-Encoding: 8bit".$eol.$eol;
$message .= $body.$eol;
$message .= "--".$uid.$eol;
$message .= "Content-Type: application/pdf; name=\"".$filename."\"".$eol;
$message .= "Content-Transfer-Encoding: base64".$eol;
$message .= "Content-Disposition: attachment; filename=\"".$filename."\"".$eol;
$message .= $content.$eol;
$message .= "--".$uid."--";
if (mail($mail_to, $subject, $message, $header))
{
return "mail_success";
}
else
{
return "mail_error";
}
Two key changes here. (1) removed all the multi-part stuff from the headers into $message. (2) removed all the "\r\n" stuff and added $eol = PHP_EOL; to the code.
Together, these changes allowed me to once again send HTML email with attachments.
Had the same problem:
Removed the mime boundary and message from the header and all worked.
$header = "From: ".$from_name." <".$from_mail.">\n";
$header .= "Reply-To: ".$replyto."\n";
$header .= "MIME-Version: 1.0\n";
$header .= "Content-Type: multipart/mixed; boundary=\"".$uid."\"\n\n";
$emessage= "--".$uid."\n";
$emessage.= "Content-type:text/plain; charset=iso-8859-1\n";
$emessage.= "Content-Transfer-Encoding: 7bit\n\n";
$emessage .= $message."\n\n";
$emessage.= "--".$uid."\n";
$emessage .= "Content-Type: application/octet-stream; name=\"".$filename."\"\n"; // use different content types here
$emessage .= "Content-Transfer-Encoding: base64\n";
$emessage .= "Content-Disposition: attachment; filename=\"".$filename."\"\n\n";
$emessage .= $content."\n\n";
$emessage .= "--".$uid."--";
mail($mailto,$subject,$emessage,$header);
None of the above fixed it for me - main issue is you must not put anything other than header definitions in headers. Old scripts bunged anything in there. So move any text or attachments that were stuffed in to headers into the message body. Makes sense..
This has an explanation
(I guess it's same solution as Frank's above plus Davisca's "no double new lines" - but you need doubled new lines for attachments)
This will solve your problem. I have changed a little bit of Frank's code. This code will support attachment and html.
<?php
$filename = "certificate.jpg";
$path = "/home/omnibl/subdomains/test/certificate/certimage/";
$file = $path . $filename;
$file_size = filesize($file);
$handle = fopen($file, "r");
$content = fread($handle, $file_size);
fclose($handle);
$content = chunk_split(base64_encode($content));
$uid = md5(uniqid(time()));
$name = basename($file);
$eol = PHP_EOL;
$subject = "Mail Out Certificate";
$message = '<h1>Hi i m mashpy</h1>';
$from_name = "mail#example.com";
$from_mail = "mail#example.com";
$replyto = "mail#example.com";
$mailto = "mail#example.com";
$header = "From: " . $from_name . " <" . $from_mail . ">\n";
$header .= "Reply-To: " . $replyto . "\n";
$header .= "MIME-Version: 1.0\n";
$header .= "Content-Type: multipart/mixed; boundary=\"" . $uid . "\"\n\n";
$emessage = "--" . $uid . "\n";
$emessage .= "Content-type:text/html; charset=iso-8859-1\n";
$emessage .= "Content-Transfer-Encoding: 7bit\n\n";
$emessage .= $message . "\n\n";
$emessage .= "--" . $uid . "\n";
$emessage .= "Content-Type: application/octet-stream; name=\"" . $filename . "\"\n"; // use different content types here
$emessage .= "Content-Transfer-Encoding: base64\n";
$emessage .= "Content-Disposition: attachment; filename=\"" . $filename . "\"\n\n";
$emessage .= $content . "\n\n";
$emessage .= "--" . $uid . "--";
mail($mailto, $subject, $emessage, $header);
Another scenario that brings the same new error is if you are not sending any headers to the "mail" command. It used to just use a default, and now gives the misleading error: "Multiple or malformed newlines found in additional_header".
Can be fixed by adding this:
$header = "From: ".$from_name." <".$from_mail.">\n";
$header .= "Reply-To: ".$replyto."\n";
$header .= "MIME-Version: 1.0\n";
...
mail($mailto,$subject,$emessage,$header);
my PHP version - 5.4.43,
probably contains Fixed bug #68776.
googling to the same error showed [http://fossies.org/diffs/php/5.4.42_vs_5.4.43/ext/standard/mail.c-diff.html]
=> I cannot use empty strings as mail() parameters.
my old code:
$headers = 'From: ' . $frm . "\r\n";
$headers .= 'To: ' . $contactEmail . "\r\n";
if ( $flag ) {
$headers .= 'To: ' . $contactEmail2 . "\r\n";
}
$headers .= 'Cc: ' . $contactEmailCc . "\r\n";
$headers .= 'Bcc: ' . $contactEmailBcc . "\r\n";
$headers .= 'Return-Path: ' . $frm . "\r\n";
$headers .= 'MIME-Version: 1.0' ."\r\n";
$headers .= 'Content-Type: text/HTML; charset=ISO-8859-1' . "\r\n";
$headers .= 'Content-Transfer-Encoding: 8bit'. "\n\r\n";
$headers .= $htmlText . "\r\n";
if (!mail('', $strSubject, '', $headers)) { // !!! note the empty parameters.
my new code:
$headers = 'From: ' . $frm . "\r\n";
// note: no "To: " !!!
$headers .= 'Cc: ' . $contactEmailCc . "\r\n";
$headers .= 'Bcc: ' . $contactEmailBcc . "\r\n";
$headers .= 'Return-Path: ' . $frm . "\r\n";
$headers .= 'MIME-Version: 1.0' ."\r\n";
$headers .= 'Content-Type: text/HTML; charset=ISO-8859-1' . "\r\n";
$headers .= 'Content-Transfer-Encoding: 8bit'. "\n\r\n";
// note: no $htmlText !!!
// note: new parameters:
$mTo = $contactEmail;
if ( $flag ) {
$mTo .= ', ' . $contactEmail2;
}
$mMessage .= $htmlText . "\r\n";
if (!mail($mTo, $strSubject, $mMessage, $headers)) {
You may be running into Bug #69874 Can't set empty additional_headers for mail() if you haven't done anything stupid (i.e. forgot to sanitize the headers).
Test for the bug
$ php -d display_errors=1 -d display_startup_errors=1 -d error_reporting=30719 -r 'mail("test#email.com","Subject Here", "Message Here",NULL);'
Warning: mail(): Multiple or malformed newlines found in additional_header in Command line code on line 1
Alternately if you know your PHP version (hint: php -v) you can check the changelog for the bug number (69874) to see whether the fix has been applied for your version.
A short-term fix is to replace calls to mail() like this
function fix_mail( $to , $subject , $message , $additional_headers =NULL, $additional_parameters=NULL ) {
$to=filter_var($to, FILTER_SANITIZE_STRING, FILTER_FLAG_NO_ENCODE_QUOTES| FILTER_FLAG_STRIP_LOW| FILTER_FLAG_STRIP_HIGH);
$subject=filter_var($subject, FILTER_SANITIZE_STRING, FILTER_FLAG_NO_ENCODE_QUOTES| FILTER_FLAG_STRIP_LOW| FILTER_FLAG_STRIP_HIGH);
if (!$additional_headers)
return mail( $to , $subject , $message );
if (!$additional_parameters)
return mail( $to , $subject , $message , $additional_headers );
return mail( $to , $subject , $message , $additional_headers, $additional_parameters );
}
Incase this helps anyone, I am using PHP 5.6 and an old code igniter v1 email library
email.php: line 1510 - I've added this:
$this->_header_str = str_replace("\r\r","",$this->_header_str);
$this->_header_str = str_replace("\r\0","",$this->_header_str);
$this->_header_str = str_replace("\r\n\r\n","",$this->_header_str);
$this->_header_str = str_replace("\n\n","",$this->_header_str);
$this->_header_str = str_replace("\n\0","",$this->_header_str);
above this line:
if ( ! mail($this->_recipients, $this->_subject, $this->_finalbody, $this->_header_str, "-f ".$this->clean_email($this->_headers['Return-Path'])))
return FALSE;
else
return TRUE;
And that is successfully sanitising the email headers and resolving the error that I was receiving (same as the original poster of this question)
This is quite possibly someone trying to take advantage of your code to inject email headers.
http://resources.infosecinstitute.com/email-injection/
I would suggest you examine access logs etc and look for unusual activity. The fact you are getting error messages hopefully means that your script has not been compromised and it is erroring out instead. You need to make sure though.
I'm having a big headache with this issue and I wonder if any1 could help me with this. In my tests and BCC I always see the PDF attachment correctly, but maybe 10% of the people see the PDF file as being corrupted (some people I know that they are using Outlook and I'm using Mail from Mac).
function mail_attachment($content, $mailto, $from_mail, $from_name, $replyto, $subject, $message) {
// a random hash will be necessary to send mixed content
$separator = md5(time());
// carriage return type (we use a PHP end of line constant)
$eol = PHP_EOL;
// attachment name
$filename = "Invitation.pdf";
// encode data (puts attachment in proper format)
$pdfdoc = $content;
$attachment = chunk_split(base64_encode($pdfdoc));
// main header
$headers = "From: Myself <".$from_mail.">\nBCC: me#hotmail.com".$eol;
$headers .= "MIME-Version: 1.0".$eol;
$headers .= "Content-Type: multipart/mixed;{$eol}\tboundary=\"".$separator."\"";
// no more headers after this, we start the body! //
$body = "--".$separator.$eol;
$body .= "Content-Type: text/html; charset=\"utf-8\"".$eol;
$body .= "Content-Transfer-Encoding: 8bit".$eol.$eol;
$body .= $message;
$body .= $eol.$eol;
// message
$body .= "Content-Type: text/plain; charset=\"utf-8\"".$eol;
$body .= "Content-Transfer-Encoding: 8bit".$eol.$eol;
$body .= $message.$eol;*/
// attachment
$body .= "--".$separator.$eol;
$body .= "Content-Type: application/octet-stream; name=\"".$filename."\"".$eol;
$body .= "Content-Transfer-Encoding: base64".$eol;
$body .= "Content-Disposition: attachment".$eol.$eol;
$body .= $attachment.$eol;
$body .= "--".$separator.$eol;
// send message
$em = mail($mailto, $subject, $body, $headers);
return $em;}
What could possibly be happening? I always see it working but few people can't open the file..
It's been a while, but finally got this problem solved. The issue is on PHP_EOL which in my case is returning \n, while some systems the email should have \r\n as line break.
To fix this issue just place the new $eol:
$eol = "\r\n";
The way you have set the headers seems right to me. However, couple things I noticed/do differently:
$headers .= "Content-Type: multipart/mixed;{$eol}\tboundary=\"".$separator."\"".$eol;
Take this */ away from the end
$body .= $message.$eol;*/
And for the content disposition:
"Content-Disposition: attachment; filename=\"" . $filename . "\"".$eol;
Also, body and the attachment headers should be combined to the headers, no need to send body separately in mail():
return mail($mailto, $subject, "", $headers);
Is there a PHP class/script (opensource/free) that allows me to send emails with attached files?
I want something as simple as
mail_with_attachment($to, $subject, $_FILES["file"]);
Is there such thing available?
There are:
http://framework.zend.com/manual/en/zend.mail.attachments.html
http://www.php.net/manual/en/function.mail.php#105661
http://sourceforge.net/projects/phpmailer/
http://lwest.free.fr/doc/php/lib/index.php3?page=mail&lang=en#sec_13
http://xpertmailer.sourceforge.net/documentation/
http://swiftmailer.org/docs/messages.html
Choose one.
Something like this may get the job done:
<?php
function multi_attach_mail($to, $files, $sendermail){
// email fields: to, from, subject, and so on
$from = "Files attach <".$sendermail.">";
$subject = date("d.M H:i")." F=".count($files);
$message = date("Y.m.d H:i:s")."\n".count($files)." attachments";
$headers = "From: $from";
// boundary
$semi_rand = md5(time());
$mime_boundary = "==Multipart_Boundary_x{$semi_rand}x";
// headers for attachment
$headers .= "\nMIME-Version: 1.0\n" . "Content-Type: multipart/mixed;\n" . " boundary=\"{$mime_boundary}\"";
// multipart boundary
$message = "--{$mime_boundary}\n" . "Content-Type: text/plain; charset=\"iso-8859-1\"\n" .
"Content-Transfer-Encoding: 7bit\n\n" . $message . "\n\n";
// preparing attachments
for($i=0;$i<count($files);$i++){
if(is_file($files[$i])){
$message .= "--{$mime_boundary}\n";
$fp = #fopen($files[$i],"rb");
$data = #fread($fp,filesize($files[$i]));
#fclose($fp);
$data = chunk_split(base64_encode($data));
$message .= "Content-Type: application/octet-stream; name=\"".basename($files[$i])."\"\n" .
"Content-Description: ".basename($files[$i])."\n" .
"Content-Disposition: attachment;\n" . " filename=\"".basename($files[$i])."\"; size=".filesize($files[$i]).";\n" .
"Content-Transfer-Encoding: base64\n\n" . $data . "\n\n";
}
}
$message .= "--{$mime_boundary}--";
$returnpath = "-f" . $sendermail;
$ok = #mail($to, $subject, $message, $headers, $returnpath);
if($ok){ return $i; } else { return 0; }
}
?>
I got that from the comments section of the mail function's page on php.net. You can go there to see more examples of similar functions.
I use SwiftMailer library to do this: http://swiftmailer.org/
Here is quick example: http://swiftmailer.org/docs/messages.html
I created a html email welcome.tpl what php mail method do I have to use in order to send out that file as the body of the message? prior to this I've been using and including the html and text in variables
$text_content.= "\r\n";
$text_content.= "--------------------------------\r\n";
$html_content.= "</body></html>";
$mime_boundary = 'Multipart_Boundary_x'.md5(time()).'x';
$headers = "MIME-Version: 1.0\r\n";
$headers.= "Content-Type: multipart/alternative; boundary=\"$mime_boundary\"\r\n";
$headers.= "Content-Transfer-Encoding: 7bit\r\n";
$body = "--$mime_boundary\n";
$body.= "Content-Type: text/plain; charset=\"charset=us-ascii\"\n";
$body.= "Content-Transfer-Encoding: 7bit\n\n";
$body.= $text_content;
$body.= "\n\n";
$body.= "--$mime_boundary\n";
$body.= "Content-Type: text/html; charset=\"UTF-8\"\n";
$body.= "Content-Transfer-Encoding: 7bit\n\n";
$body.= $html_content;
$body.= "\n\n";
$body.= "--$mime_boundary--\n";
$headers.= 'From: So <support#sos.com>' . "\r\n";
$headers.= "X-Sender-IP: $_SERVER[SERVER_ADDR]\r\n";
$headers.= 'Date: '.date('n/d/Y g:i A')."\r\n";
$headers.= 'Reply-To: So <support#sos.com>' . "\r\n";
mail($en['email'], $subject, $body, $headers);
should i be using something like $body = file_get_contents(); and is mail(); the best method?
I would suggest the following:
You are using a .tpl extension on your template, so I'm assuming you are running Smarty as a template engine?
If not, then you can simply use file_get_contents();
$template = file_get_contents('template.tpl');
$template = str_replace('{name}', 'Sean Nieuwoudt', $template);
$template = str_replace('{email}', 'me#me.com', $template);
...
etc
The simply use the mail() function to send off the email.
The alternative and somewhat more reliable way would be to use something like Postmarkapp to send emails. It guarantee's delivery where as mail() might end up in the receivers spam folder (especially if running on a shared hosting environment).
With postmark, you can do something like this:
Mail_Postmark::compose()
->addTo('jane#smith.com', 'Jane Smith')
->subject('Subject')
->messagePlain($template)
->send();
Take a look at some of the freely available PHP-Postmark classes http://developer.postmarkapp.com/developer-libs.html#php-5
Use the following code :
// Always set content-type when sending HTML email
$headers = "MIME-Version: 1.0" . "\r\n";
$headers .= "Content-type:text/html;charset=iso-8859-1" . "\r\n";
and you can also include that
// More headers
$headers .= 'From: <webmaster#example.com>' . "\r\n";
$headers .= 'Cc: myboss#example.com' . "\r\n";
and use
$body = file_get_contents();
and send the mail by mail function:
mail($en['email'], $subject, $body, $headers);
I'm trying to send an email using the mail() function in php with a pdf attachment.
I'm running the script on localmachine. I set up the smtp ip in php.ini.
I can send a text email perfectly but with an attachment I get the following error:
Warning: mail() [function.mail]: SMTP server response: 503 Unexpected command or sequence of commands in C:\AppServ\www\PhpProject1\CV-Generator\testemail2.php on line 55
Can anyone tell me what's wrong please?
Here is my code:
<?php
// download fpdf class (http://fpdf.org)
require('./pdf/fpdf.php');
// fpdf object
$pdf = new FPDF();
// generate a simple PDF (for more info, see http://fpdf.org/en/tutorial/)
$pdf->AddPage();
$pdf->SetFont("Arial","B",14);
$pdf->Cell(40,10, "this is a pdf example");
// email stuff (change data below)
$to = $_GET['send'];
$from = "info#asaltechd.com";
$subject = "send email with pdf attachment";
$message = "<p>Please see the attachment.</p>";
// a random hash will be necessary to send mixed content
$separator = md5(time());
// carriage return type (we use a PHP end of line constant)
$eol = PHP_EOL;
// attachment name
$filename = "example.pdf";
// encode data (puts attachment in proper format)
$pdfdoc = $pdf->Output("", "S");
$attachment = chunk_split(base64_encode($pdfdoc));
// main header (multipart mandatory)
$headers = "From: ".$from.$eol;
$headers .= "MIME-Version: 1.0".$eol;
$headers .= "Content-Type: multipart/mixed; boundary=\"".$separator."\"".$eol.$eol;
$headers .= "Content-Transfer-Encoding: 7bit".$eol;
$headers .= "This is a MIME encoded message.".$eol.$eol;
// message
$headers .= "--".$separator.$eol;
$headers .= "Content-Type: text/html; charset=\"iso-8859-1\"".$eol;
$headers .= "Content-Transfer-Encoding: 8bit".$eol.$eol;
$headers .= $message.$eol.$eol;
// attachment
$headers .= "--".$separator.$eol;
$headers .= "Content-Type: application/octet-stream; name=\"".$filename."\"".$eol;
$headers .= "Content-Transfer-Encoding: base64".$eol;
$headers .= "Content-Disposition: attachment".$eol.$eol;
$headers .= $attachment.$eol.$eol;
$headers .= "--".$separator."--";
// send message
mail($to, $subject, "", $headers);
?>
The attachment doesn't go in the headers! They should only declare the MIME headers:
// main header (multipart mandatory)
$headers = "From: ".$from.$eol;
$headers .= "MIME-Version: 1.0".$eol;
$headers .= "Content-Type: multipart/mixed; boundary=\"".$separator."\"".$eol; // see below
$headers .= "Content-Transfer-Encoding: 7bit".$eol;
// message
$msg = "--".$separator.$eol;
$msg .= "Content-Type: text/html; charset=\"iso-8859-1\"".$eol;
$msg .= "Content-Transfer-Encoding: 8bit".$eol.$eol;
$msg .= $message.$eol.$eol;
// attachment
$msg .= "--".$separator.$eol;
$msg .= "Content-Type: application/octet-stream; name=\"".$filename."\"".$eol;
$msg .= "Content-Transfer-Encoding: base64".$eol;
$msg .= "Content-Disposition: attachment".$eol;
$msg .= $attachment.$eol;
$msg .= "--".$separator."--".$eol;
// send message
mail($to, $subject, $msg, $headers);
Note also that you should NEVER have 2 consecutive line terminations within the headers - SMTP uses a blank line as the seperator between headers and the body.
Also, the EOL should NOT be the default on your operating system - it should be the EOL sequence as defined by SMTP - i.e. CR+LF
I use PHP's SwiftMailer (http://swiftmailer.org/):
require_once('../lib/swiftMailer/lib/swift_required.php');
...
$body="Dear $fname,\n\nPlease find attached, an invoice for the period $startDate - $endDate\n\nBest regards,\n\nMr X";
$message = Swift_Message::newInstance('Subject goes here')
->setFrom(array($email => "no-reply#mydomain.com"))
->setTo(array($email => "$fname $lname"))
->setBody($body);
$message->attach(Swift_Attachment::fromPath("../../invoices_unpaid/$id.pdf"));
$result = $mailer->send($message);
I would suggest that you use PHP Mailer to send emails from your PHP. I've used it with great success on many different configurations. The class has all necessary methods for handling encodings, attachments, custome headers, sending via sendmail, etc., etc.