Just use a PHP header to redirect the user instead of the echo ( http://php.net/manual/en/function.header.php ).

header('Location: /path/to/url.php');

Ok first, thing, get rid of the $_SERVER['REQUEST_METHOD'].  Right now if a form is set to post at your address it will be processed.  Spam bots love these forms because you are not actually checking if your own form was submitted.  You should usually only need to check if $_POST['something'] is submitted.  I know I didn't say this before but I should have.

Next, move the <?php ?> to the beginning of the document before the <!DOCTYPE declaration.

Now, eliminate the "else" statement.

Next eliminate the "echo Thank you" line and the $_POST = array(); line.  $_POST is a superglobal and always an array so you should never have to define it. And if you are redirecting someone, there is nothing you need to echo.

So now your code should be down to:

<?php

if ( isset($_POST['submit']) && !empty($_POST['submit')) //Test if submit button named submit was clicked and not empty

{

          if (!empty($_POST['first']) && !empty($_POST['last'])  && !empty($_POST['email'])) {

                    $body = "First Name: {$_POST['first']}\nLast Name: {$_POST['last']}\nEMail Address: {$_POST['email']}\nContact Phone Number: {$_POST['phone']}\nContact Preference: {$_POST['contactvia']}\nBest Time To Contact: {$_POST['timepref']}\nComments:\n {$_POST['comment']}";

                    $body = wordwrap($body, 70);

 

                    mail('someone@someplace.net', 'NEW Customer Inquiry Submission',$body, "From: {$_POST['email']}");

                    header('Location: url.php');  //Redirect to new url if form submitted

     }

}

?>

<!DOCTYPE

 

Just move that "Please fill out the form" text to the actual page above the form.  Then if the user submitted the form, they will get redirected, if not they see the page.  Make sense?

Yes.  But when it attacks these scripts it's called injection (google something like "prevent SQL injection").  Injection is where a bot tries to inject bad code into your script because data is not being validated.  One example of this, is a comments box.  Because you are not using stripslashes ( http://php.net/manual/en/function.stripslashes.php ) on the code, someone could put a single quote mark followed by PHP code.  When you use a function like stripslashes the code comments out quote marks so it doesn't think it's part of the script, sanitizing your data input and protecting your site.

This is a basic example of something you should be aware of for security.  There are much better examples of how you should sanitize data, but it will take some time to learn and there are many more functions like that stripslashes that all have different functions like converting all special characters to HTML entities. 

Actually, using the header function is not the only way. It would be an alternative to echo javascript to change the document location. Like so:

echo '

<script type="text/javascript">

document.location = "URL Where you want.com/example.php"

</script>

';

It's just another way!

Alex Liebscher

No problem. I'm not sure if my way is any safer/faster/ more reliable though!

Alex Liebscher