---

mailform.cgi

---

The original of this document is at http://www.it.ca/software/mailform.

it.canada has contribued this mail form processor to the Internet community, free of charge. Feel free to use it in your own site development.

mailform.cgi is a simple CGI script that generically takes form content and sends it somewhere via email. It's smart enough to send only the variables you specify in your form, and it gives you fairly precise control over the headers in the resultant email. It was designed to be a simple alternative to the ubiquitous (and insecure) formmail.pl from Matt's Script Archive.

For basic use of the mailform.cgi, you must at least specify the following variables:

For more fine-tuned control the behaviour of mailform.cgi, you may specify the following variables within your form:

The MailTo and NextPage variables are the only ones that are required; the script will use sensible default values for the other variables if they are not specified. Note that you can specify multiple email addresses for the MailTo, MailCC and MailBCC fields.

You should POST to this CGI, and make the form look something like:

<form method=post action="http://www.it.ca/cgi-bin/mailform.cgi">
 <input type=hidden name=MailTo      value="youraddress@example.com">
 <input type=hidden name=MailSubject value="Email form submission">
 <input type=hidden name=NextPage    value="http://www.example.com/thanks.html">

NOTE: You may recycle your form variables within the control variables by specifying the variable name prepended with a '$' character in the value field. Thus the following will cause the form's content to be sent to the email address specified in the form itself:

<form method=post action="http://www.it.ca/cgi-bin/mailform.cgi">
 <input type=hidden name=MailTo       value="$Email">
 <input type=hidden name=MailFrom     value="webmaster@it.ca">
 <input type=hidden name=MailFromText value="Mailform.cgi example">
 <input type=hidden name=MailSubject  value="This one likes $Colour">
 <input type=hidden name=NextPage     value="/software/mailform">
 <p>   Your name:        <input type=text name=Name>
  <br> Email address:    <input type=text name=Email>
  <br> Favourite colour: <input type=text name=Colour>
  <br> <input type=submit value="Submit form">
 </p>
</form>

Turn this around, with $Email on the MailFrom field, and you'll receive a message that is From the address they specified, so you can respond to it as if it were normal email.

You can see the whole thing in action here. The following form is based on the source code above.

You can make the form submission secure simply by referring to the CGI securely. That is, http can be replaced with https is the form's action field. Note that while this will ensure that the form is submitted securely to mailform.cgi by the browser, the resultant email will by default still be sent unencrypted, posing a security concern for some data. Switching back and forth between encrypted and unencrypted pages may also cause some browsers to complain with security warnings.

If you are using PHP or another scripting technology that accepts variables as part of an HTTP GET, you can use the personalize your NextPage using form content by passing the variables in the NextPage field. Following the example above, a possible line might be:

<input type=hidden name=NextPage value="thanks.php?Name=$Name&Email=$Email">

The mailform.cgi script is © 1998-2003 Paul Chvostek, and is not available for public distribution at this time. The CGI is however publicly available for your use. If you find it handy, donations via PayPal to software@it.ca would be gratefully accepted.

If you're in need of hosting services, from virtualhosting to server co-location, please consider it.canada. Information about our products and services is available here.