Additional text in the email body - php

Question

I'm building a simple order system and want to send an email after the form is submitted. My PHP code looks similar to this:
$name=$_POST["orderName"];
$company=$_POST["orderCompany"];
$email=$_POST["orderEmail"];
$phone=$_POST["orderPhone"];
$headers = "From: $email\r\n" .
$item1=$_POST["orderItem1"];
$qty1=$_POST["orderQty1"];
$item2=$_POST["orderItem2"];
$qty2=$_POST["orderQty2"];
$item3=$_POST["orderItem3"];
$qty3=$_POST["orderQty3"];
$date = date("l, F j Y, G:i") ;
$message="Message sent: $date \n\n
Name: $name\n
Company: $company\n
Email: $email\n
Phone: $phone\n\n
Order:\n
$item1 \tx$qty1\n
$item2 \tx$qty2\n
$item3 \tx$qty3\n";
mail("sales#company.com", "Order", $message, $headers);
That works fine, except in the body of the email I get the value of $item1 string at the very beginning, before the "Message sent..." - just like I added it to the $message (which I don't as far as I can see).

Answer 1

Where you have this:
$headers = "From: $email\r\n" .
you want this instead:
$headers = "From: $email\r\n";
Otherwise, you're concatenating whatever comes on the next line (which happens to be the definition for $item1) to the end of $headers. Although that's not technically valid (i.e., the content is part of the message headers and not body), most e-mail clients will effectively shrug and show it anyway.

Answer 2

Please, please, please add some sanitizing to your POST variables before going with this in production.
Let's see here:
$email=$_POST["orderEmail"];
$headers = "From: $email\r\n";
mail("sales#company.com", "Order", $message, $headers);
I could send a POST request where "orderEmail" contains:
"helo#helo.lv\r\n
From: viagra#farmacety.net\r\n
BCC: victim1#domain1.com, victom2#domain3.com"
etc. and your harmless form would work great for me sending spam to the whole world. This site suggects:
if ( ereg( "[\r\n]", $name ) || ereg( "[\r\n]", $email ) ) {
[... direct user to an error page and quit ...]
}