html help on my contact form please? - html

Question

I need some help, I'm building a website for a good friend and I need some help with the contact form. I found the code online but it's not working correctly. It sends the e-mail but not all the forms correctly, and doesn't send the picture. Also, when I send the form, it should link to the page contactus.html, but the link doesn't seem to work either. Can anyone help correct this code, this would help SO much. Thank you so, so much.
Here is the HTML for the contact form:
<div id="stylized" class="myform">
<form id="form" id="form" action="mail.php" method="POST">
<label>Name
<span class="small">Add your name</span>
</label>
<input type="text" name="name">
<label>Address
<span class="small">Add your home address</span>
</label>
<input type="text" name="address">
<label>Phone
<span class="small">Add a Phone Number</span>
</label>
<input type="text" name="phone">
<label>E-mail
<span class="small">Enter a valid E-mail</span>
</label>
<input type="text" name="email">
<label>Timeline
<span class="small">Range for your project</span>
</label>
<input type="text" name="timeline">
<label>Photo
<span class="small">Upload current picture</span>
</label>
<input type="file" name="photo">
<label>Description
<span class="small">Type Your Project Description</span>
</label>
<textarea name="message" rows="6" cols="25"></textarea>
<button type="submit" value="Send" style="margin-top:15px;">Submit</button>
<div class="spacer"></div>
</form>
</div>
And here is mail.php, which is supposed to help make the form work. I think here is where the problem is:
<?php $name = $_POST['name'];
$address = $_POST['address'];
$phone = $_POST['phone'];
$email = $_POST['email'];
$timeline = $_POST['timeline'];
$description = $_POST['description'];
$formcontent="From: $name \n Message: $message";
$recipient = "blanger#hawaii.edu";
$subject = "New Project Request from 2DadsDB.com";
$mailheader = "From: $email \r\n";
mail($recipient, $subject, $formcontent, $mailheader) or die("Error!");
echo "Thank You!" . " -" . "<a href='contactus.html'>Go Back</a>";
?>

Answer 1

As Blender pointed out the code is very insecure. It's easy for malicious content to be inserted. Also there's no reference in the mail.php to "photo"
$fileImage = $_POST['photo'];
You'll need to use a script to upload and store the photo I believe. It's best too look at a tutorial or complete source instead of building from scratch.

Answer 2

The mail() function is good for only message sending.
To send an image First you need to upload your photo to the server To upload an image.
To send an image using mail() first attach your photo from server to mail() PHP e-mail attachment script
And use $name = mysql_real_escape_string(strip_tags($_POST['name']));
for each post like name,e-mail etc., for security purpose.

Answer 3

You should sanitize your imputs.Use mysql_real_escape_string or stripslashes function on each of the $_POST.
$user = mysql_real_escape_string($_POST['user']);