Reputation: 1361
I'm send an email for a user, i make a query:
$consulta = mysql_query("SELECT * FROM users WHERE email = '$emailDestinatario'");
if($consulta === FALSE) {
(header('Location: http://l2prime.org/index.php?login=success') xor die(mysql_error()));
} while($row = mysql_fetch_array($consulta))
{
$username = $row['username'];
}
}
Then i have the $body that's the variable for the body message on email:
$body = '
<html>
<head>
<title>Recuperação de password.</title>
</head>
<body>
<h3>Dear <?php echo $username?>,</h3>
<p>
<b>Some text here.</b>
</p>
</body>
</html>
';
That's <?php echo $username?>
doesn't work, the email arrives "Dear ,", no username at all.
Could anyone help me in this one?
Thank you in advance.
Best regards, Marcelo
Upvotes: 0
Views: 94
Reputation: 397
You can use <<<EOF:
$body = <<<EOF
Something Something {$var} Something Something
Something Something
Something Something Something {$var2}
EOF;
P.S. Why is everybody so worried with SQL injection here? He just wants to send an e-mail, not to query a database..
Upvotes: 0
Reputation:
You don't need a <?php
again in the script. It should be:
$body = '
<html>
<head>
<title>Recuperação de password.</title>
</head>
<body>
<h3>Dear '. strip_tags($username) .',</h3>
<p>
<b>Some text here.</b>
</p>
</body>
</html>
';
So, if $username = "foo";
, it will output:
Dear foo,
Some text here.
strip_tags function will strip out HTML / PHP tags from a given string. It's safer.
Upvotes: 0
Reputation: 6274
I think its pretty obvious
$body = '
<html>
<head>
<title>Recuperação de password.</title>
</head>
<body>
<h3>Dear '.$username.',</h3>
<p>
<b>Some text here.</b>
</p>
</body>
</html>
';
also you could have something like this:
$body = '
<html>
<head>
<title>Recuperação de password.</title>
</head>
<body>
<h3>Dear VARIABLE_USERNAME,</h3>
<p>
<b>Some text here.
Regards,
VARIABLE_SITE_NAME
</b>
</p>
</body>
</html>
';
and then you could replace the VARIABLE_USERNAME and VARIABLE_SITE_NAME and other VARIABLE_XXXXXX with appropriate values:
$body = str_replace("VARIABLE_USERNAME",$username,$body);
$body = str_replace("VARIABLE_SITE_NAME",$site_name,$body);
Upvotes: 2