Variable not working in mail form? - php

Question

I have a HTML form with 4 id (name, email, message, subject), a js with all the variables declared and a PHP that should send the mail.
HTML
<form id="formail" method="post" action="">
<input type="text" id="nome" name="nome" value="" size="22" /><br />
<input type="text" id="email" name="email" value="" size="54" /><br />
<textarea id="messaggio" name="messaggio" rows="1" cols="55" style="resize: none;"></textarea><br />
<input type="text" id="subject" name="subject" value="" size="22" /><br />
<input type="submit" id="send" name="send" value="" style="cursor: pointer"/>
<br />
<div id="answer"></div>
</form>
This is the js
var valid = '';
var isr = ' requested.</h6>';
var name = $("#nome").val();
var mail = $("#email").val();
var subject = $("#subject").val();
var messaggio = $("#messaggio").val();
(follow controls about the name and mail, and the send function)
This is the php
$mail = trim($_POST['mail']);
$name = $_POST['name'];
$text = $_POST['messaggio'];
$subject = $_POST['subject'];
$ip = $_SERVER['REMOTE_ADDR'];
$to = "admin#test.com";
$message = "Username: ".$name.", ".$mail.".<br />";
$message .= "Subject: ".$subject.".<br />";
$message .= "Messaggio: <br />".$text."<br /><br />";
$message .= "IP: ".$ip."<br />";
$headers = "From: ".$mail." \r\n";
$headers .= "Reply-To: ".$mail." \r\n";
$headers .= "MIME-Version: 1.0 \n";
$headers .= "Content-Type: text/html; charset=ISO-8859-1 \n";
if(mail($to, $subject, $message, $headers)){
echo "<h6>Message sent!</h6>";
}
I posted only the relevant code. When I click send I'll receive the mail, however the field "subject" is blank, as if the variables "subject" had been ignored.
Could you please help me? I'm starting to learn PHP but I'm still a newbie. Thank you.

Answer 1

Where is your mail function?
use following mail function:
mail($to-mail,$subject,$message,$header);

Answer 2

Two key points here:
a) Not sure exactly what function you're using to actually send the mail, but assuming PHP mail() you will need to use the $subject as the second parameter.
b) If you publish this on the open web you will be exploited as an open relay by spammers.
The attack you are vulnerable to is called 'header injection'.
In short, if I submit my 'mail' value as myemail#example.org%0ABcc:poorsap#example.com the script will add an extra line (the %0A is a linefeed), and submit to mail() with an extra Bcc header for however many emails I like (in this case poorsap#example.org).
Please take a read through this: http://www.securephpwiki.com/index.php/Email_Injection and consider using an alternate library to avoid this problem.