<?

// The below lines are called "ternary operators".  They are required for your security.
// Basically, it defines the "$foo" value like so (if you want the English translation):
// 
// "If the posting of $foo exists, then the value of $foo is taken : otherwise, the value
// if $foo is nothing."
//
// Basically, in versions PHP 4 and older, it would not throw out an error when an expected
// variable that needed a definition was not defined.  PHP 4 and older would let it slide.
// However, it was discovered that "letting it slide" posed a security risk.  This brings
// it up to par, and assists in the security of this form by not allowing any variables come
// through undefined.
//
// So, after that explanation, you should know that for EVERY variable you have in the form, 
// you MUST have a line like this that matches it.  I already have the lines that already occur
// in the HTML document as you have downloaded it - but shoudl you ever add a field, you must
// be sure you add the line here to match that variable so the form will remain secure.

isset($_POST['action']) ? $action = $_POST['action'] : $action = '';
isset($_POST['first_name']) ? $first_name = $_POST['first_name'] : $first_name = '';
isset($_POST['last_name']) ? $last_name = $_POST['last_name'] : $last_name = '';
isset($_POST['city']) ? $city = $_POST['city'] : $city = '';
isset($_POST['provincestate']) ? $provincestate = $_POST['provincestate'] : $provincestate = '';
isset($_POST['country']) ? $country = $_POST['country'] : $country = '';
isset($_POST['phone']) ? $phone = $_POST['phone'] : $phone = '';
isset($_POST['email']) ? $email = $_POST['email'] : $email = '';
isset($_POST['mailto']) ? $mailto = $_POST['mailto'] : $mailto = '';

isset($_POST['error']) ? $error = $_POST['error'] : $error = '';
isset($_POST['first_name_error']) ? $first_name_error = $_POST['first_name_error'] : $first_name_error = '';
isset($_POST['last_name_error']) ? $last_name_error = $_POST['last_name_error'] : $last_name_error = '';
isset($_POST['city_error']) ? $city_error = $_POST['city_error'] : $city_error = '';
isset($_POST['provincestate_error']) ? $provincestate_error = $_POST['provincestate_error'] : $provincestate_error = '';
isset($_POST['country_error']) ? $country_error = $_POST['country_error'] : $country_error = '';
isset($_POST['phone_error']) ? $phone_error = $_POST['phone_error'] : $phone_error = '';
isset($_POST['email_error']) ? $email_error = $_POST['email_error'] : $email_error = '';
isset($_POST['mailto_error']) ? $mailto_error = $_POST['mailto_error'] : $mailto_error = '';
isset($_POST['injection_error']) ? $injection_error = $_POST['injection_error'] : $injection_error = '';
isset($_POST['send']) ? $send = $_POST['send'] : $send = '';

// The following section basically says:
//
// "If the end user comes to the page for the first time (by opening it in a browser window),
// then display the file "complex.html", but take no other action yet."

if($action !="sendmail"){
    include ("complex.html");
    exit;
}

// The rest of this file is the action taken when the end user fills out the form and hits
// "submit".  It will cycle through all of these requirements below to see if everything
// will pass muster before it is passed through as a valid email attempt.
//
// So, the first part says..."if the end user hits the "submit" button, we must first check the
// input of the required fields in the form."

if ($action == "sendmail") {

// The PHP will look at the required fields, and if any of them have been left blank, then it
// will assign the variable a number - being "1", and then move on to the "send" function, 
// defined as the last varible in this section.  "Send = no" basically says:
//
// "If $foo = 1, then return the end user to the "complex.html" page, and show the corresponding 
// error messages."
//
// In the case of the email address, not only will it return an error if the field is left
// blank, it will also check that the email address is entered in the proper format.  In other
// words, any version other than "name@domain.extension", then it will return an error. 
// This, however, will NOT validate whether or not it's a real, actual email address that works.
//
// In the case of the phone number, it will check to be sure the phone number is entered in the
// proper formats: (xxx)xxx-xxxx, xxx-xxx-xxxx, xxx.xxx.xxxx, xxxxxxxxxx (spaces are allowed).  
// If there is any deviation from these formats, an error will be returned.

	    if ($first_name == "") {

		$first_name_error = "1";

        	$send = "no";

	    		     }

	    if ($last_name == "") {

		$last_name_error = "1";

        	$send = "no";

	    		     }


	    if ($city == "") {

		$city_error = "1";

        	$send = "no";

	    		     }


	    if ($provincestate == "") {

		$provincestate_error = "1";

        	$send = "no";

	    		     }


	    if ($country == "") {

		$country_error = "1";

        	$send = "no";

	    		     }

    	    if (!ereg('(^(.*)[0-9]{3})(.*)([0-9]{3})(.*)([0-9]{4}$)', $phone)) {
		$phone_error = "1";
        	$send = "no";

    			     }

	    if (!ereg('^[-!#$%&\'*+\\./0-9=?A-Z^_`a-z{|}~]+'.'@'.'[-!#$%&\'*+\\/0-9=?A-Z^_`a-z{|}~]+\.'.'[-!#$%&\'*+\\./0-9=?A-Z^_`a-z{|}~]+$', $email) || ereg("'", $email)) {
		$email_error = "1";

        	$send = "no";

	    		     }


// This is the "swtuch" function - which goes along with the "nature of your inquiry" dropdown.
// basically, you enter in the email addresses of your choice.  So if you or your client want
// different emails to go to different departments within your business, simply change the
// email address here, and on the HTML form, change your "sales, support" etc. to the
// corresponding description. 
//
//The "default" is the email address that will be defaulted to, if no choice is selected from
// the dropdown box.  However, if you would like to make this a required field:
//	1) in the HTML document, create a new php error line that corresponds with $mailto.
//	2) in the "switch" area, there are fields that are commented out.  Uncomment them.  
//	3) comment out or delete the "default" section - the last two lines.
//
//	Voila!  The "select your inquiry" field is now required.
//
// If you only have one email address, but you would like different subject lines in your
// incoming emails, you can simply change the actual email address to a subject line.  
// I'll show you later how to make the change elsewhere so it shows up properly in your incoming
// mailings.
//
// But to do so, you have to make a couple of changes in this area and the HTML:
//
//	1) in the HTML file, change all instance of $mailto to $subject.
//	2) in the below section, change all instances of $mailto to $subject.
//	3) In the HTML document, create a new PHP error line that corresponds to $subject.
//	4) in the below section, change all email addresses to different subject lines.


	    if ($send == "no") {

		$error = "1";

        	include("complex.html");
		exit;

	    		     }


// Here is where we prevent form mail injection.  Basically, it searches for common header
// injection attempts, which require the use of /r, /n, Bcc: and so on.  (you will note that
// it's not necessary to check the "email" and "phone" input, as it is already checked for valid 
// formatting above - it already will not accept these types of input). It will search for these  
// injection attempts within the end user's input...

    $name = "$first_name $last_name";
    $find = array("/\r/", "/\n/", "/bcc\:/i", "/Content\-Type\:/i", "/cc\:/i", "/to\:/i");
    $test_name = preg_replace($find, "", $name);
    $test_city = preg_replace($find, "", $city);
    $test_provincestate = preg_replace($find, "", $provincestate);

// Here, it will allow \r and \n in textarea input, so if the end user puts in a long message
// to you with carriage returns, it won't reject it simply because the guy hit "enter" to 
// create a line break.  It *will* however, still search for the other fields that are
// recognized as in jection attempts...

    $find = array("/bcc\:/i", "/Content\-Type\:/i", "/cc\:/i", "/to\:/i");

    if (($name != $test_name) || ($city != $test_city) || ($provincestate != $test_provincestate) ) {

// Now, if an injection attempt is detected, it will return the end user to error message, in
// this case, back to the form with an error message displayed.

	$error = "1";
	$injection_error = "1";
	include("complex.html");
	exit;

// If you'd rather have the end user be returned to a completely new page with an explanation
// as to why they're being denied, then comment out the above four lines, and uncomment the 
// following two lines:
//
//      include ("spam.html");
//	exit;

// Now, if all of the above passes muster, and it's valid input, then....

    } else {

// ..send the mail!  The $message is basically the body of the email, with all of the end user's
// input stuck in here.
//
// By the way, if you're switching the $mailto up above to change subject lines instead of email 
// addresses, then delete or comment out the $subject line here.

	// $subject = "request_whitepaper_fr_e-response.com_itMission";

    	$message = nl2br("
		
		$first_name $last_name has requested information about the Emergency Response system.
			  
			  $city, $provincestate 
			  $country
			  Phone: $phone
			  
			  $email

			   ");

// This will seperate the end user's survey question selections with commas, so it doesn't
// come through to you looking like one endless line of data.  It'll now look more like a
// readable sentence.

			  
// This line is to remove the slashes that PHP puts in when it gets " or ' within the message.
// Typically, if the end user write the word "it's", for example, it will come through to your
// mailbox as "it/'s.  Kind of annoying.  The below removes those slashes to reduce the
// amount of annoyance. :)

	$message = stripSlashes($message);

// Here is your important information: *where* the email will go.  (See? no need to a hidden
// input field in the HTML document, so that stuff is picked up by spammers.  Let's leave the 
// spammers out of it!)
//
// This is also where you can change the email address or subject line information.  Note that
// next to YOUR NAME OR COMPANY NAME HERE it says <$mailto> - this is where the current
// set up will drop in the email address listed above in the "switch" function.  Now, if you 
// have only one email address, and want to swutch the subject line, then replace the 
// <$mailto> with <EMAIL@ADDRESS.COM> (the correct email address).


	$mailheader = "From: $name <$email>\nContent-Type: text/html";


	mail("info@theemergencyresponse.com","Information Request from Emergency Response Site","$message","$mailheader");
}

// Return the end user to a "Thank you!" page to let them know the email came through.

		   
{
	include("thankyou.html");

	exit;

}


}
// THE END!
 ?>