I have a static .html site and I want to implement a very simple subscription form. It will be implemented together with an external javascript lightbox popup hosted by a third-party developer which is why my subscription form will only be a simple one.

I don't have much knowledge in HTML/PHP programming. So upon searching online, I found a template code that looks like below:

In my .html page:

<form action="mail.php" method="POST">
<p>Name</p> <input type="text" name="name">
<p>Email</p> <input type="text" name="email">
<input type="submit" value="Send">

And in my mail.php:

<?php $name = $_POST['name'];
$email = $_POST['email'];
$formcontent="From: $name";
$recipient = "[email protected]";
$subject = "Subscription Form";
$mailheader = "From: $email \r\n";
mail($recipient, $subject, $formcontent, $mailheader) or die("Error!");
echo "Thank You!";

So far, the above is working. BUT I also want to automatically include the referring page on the form, that is the page within my website where they submitted the info in the subscription form. Because the subscription form will be on many different pages of the site, obtaining this information is valuable so I know what page is generating the most subscription.

I understand that there's a feature called "HTTP_REFERER"

But I don't know how to code and where to put that code so that the referral link will also be submitted on the email.

Can someone help with what I need to do or add using the sample codes I used above?

Note that I understand security issues but this is only a basic sample form (security modifications will be added later on) and I just need to know how HTTP_REFERER can be added.

Many thanks!

  • 2
    Your code has security problems. Your form can be used to send spam. You have to sanitize your user input rather than use directly in mail email headers. Rather than write your own contact form, use the free, customizable, open source one that I wrote. It is much more secure. ostermiller.org/contactform Feb 4, 2021 at 16:30
  • HTTP_REFERER is restricted/blocked in many cases for many reasons (privacy concerns, etc.) but I don't think you need it for what you're attempting, because the referring page is always on your own website. This could be done by automatically inserting a hidden field with the page title or other identifier. Stephen's point about security is important. (But... I can't think of any real problems caused by a user faking the input in THIS particular field. If it's just for your information/curiosity, and there's nothing for the user to gain based on that data, security is a little less important.)
    – Trich
    Feb 4, 2021 at 19:26
  • 1
    @Trich Using unsanitized input in email headers allows the addition of arbitrary additional headers. If somebody used the from address as [email protected]\r\nTo: [email protected] they would be able to send a spam copy of the message to Bob. It might be possible to craft malware attachments or any number of other malicious attacks. Feb 4, 2021 at 19:39
  • @StephenOstermiller - Yes, but my idea didn't involve sending the page ref / ID in this way. It may be more complicated with whichever third-party service is used by the OP, but is there any reason this hidden field couldn't be treated differently (sent/stored outside of email headers)?
    – Trich
    Feb 4, 2021 at 20:46
  • Yes, hidden fields or $_SERVER['HTTP_REFERER'] could be included in the message, either as headers or in the body. Like other submitted values they should checked to make sure they are in the expected format (sanitized) before they are used. Feb 4, 2021 at 21:22


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Browse other questions tagged or ask your own question.