Structure of the code
I have three files, CorePHP.php, verifyEmail.php and Registration.php.
I am making a sign up system for my website with these files. Registration.php holds the UI and JS code for the sign up page while verifyEmail.php holds the php code necessary to send the email for verification to the user. CorePHP.php holds the necessary JS functions for verifyEmail.php, namely createCookie() and SendEmail() functions. The verifyEmail.php file is called by AJAX in Registration.php and the data echoed in the verifyEmail.php file is recieved in the variable data in Registration.php. I include the php file of CorePHP.php in the verifyEmail.php file to get the reference of the functions necessary and call those functions using this code below –
verifyEmail.php
$subject = "Do not reply. Udyam BMS email verification.";
$body = "Hello Future User! <br> This email is sent to verify the email ID with which you are trying to sign in to Udyam BMS. Enter this code- $code in the registration page to verify your email ID. <p style='color: red'>Do not share the code with anyone else</p>";
$to = $email;
echo "<script>
var message = SendEmail(`$subject`, `$body`, `$to`);
createCookie('emailVStatus', message, 1);
</script>";
I create the cookie emailVStatus so that I can access it in PHP and get to know the status of the SendEmail() function (The function returns 1 or 0 based on the success of sending the email).
Also, the CorePHP.php file looks like –
CorePHP.php
<?php
//some irrelevant php code
?>
<html>
<body>
<script>
//The functions required are defined here
function SendEmail(subject, body, to, cc, bcc) {
var dataJson = JSON.stringify({
"to": to,
"cc": cc,
"bcc": bcc,
"subject": subject,
"emailbody": body
});
var urlStr = "https://prod-12.centralindia.logic.azure.com:443/workflows/918a1e4a479e460b82d5073e973fc46d/triggers/manual/paths/invoke?api-version=2016-06-01&sp=%2Ftriggers%2Fmanual%2Frun&sv=1.0&sig=C7KmI5P5x0vLOYqYgzuA5P-zjUEDDRutLPuPec8nXLc";
var ajax = new XMLHttpRequest();
ajax.open("POST", urlStr, true);
ajax.setRequestHeader("Content-Type", "application/json;charset=UTF-8");
ajax.onreadystatechange = function() {
if (this.readyState == 4 && this.status == 200) {
var emailmessage = 0;
return emailmessage;
}
if (this.status >= 400) {
var emailmessage = 1;
return emailmessage;
}
};
ajax.send(dataJson);
}
function createCookie(name, value, days) {
var expires;
if (days) {
var date = new Date();
date.setTime(date.getTime() + (days * 24 * 60 * 60 * 1000));
expires = "; expires=" + date.toGMTString();
} else {
expires = "";
}
document.cookie = escape(name) + "=" + escape(value) + expires + "; path=/";
}
</script>
</body>
</html>
Expected Output
In Registration.php file, I expected the data returned in data variable should only contain an array of the structure [*the message returned by the file to be displayed*, *a status code (1 or 0)*]. A record is also inserted into a MySQL table and an email is sent for verification by the verifyEmail.php file.
Problem
The problem with this code is, instead of the expected result in data variable, the data variable, it seems, contains the whole HTML part of CorePHP.php and the echoed <script></script> in verifyEmail.php. It did not even execute those functions in JS and instead passed it as returned data to the AJAX call in Registration.php. It performed the MySQL query for inserting an record fine but did not call these JS functions.
Things I have tried to solve this
I tried to remove the JS functions from the verifyEmail.php file but it cannot be done because the SendEmail() function works with an API and therefore uses an AJAX call and I do not think that it would be able to run in PHP (or would it? I am new to this stuff and don’t know much about this). So, I tried to instead call these JS functions after the AJAX call is made and the record has been inserted in Registration.php but the purpose of sending the email is that a randomly generated code is sent in it and the user has to input it in Registration.php to verify their email ID and if I send the email from the same file, the user would be able to know the randomly generated code if he/she knows how to use inspect tools in the browser which will be a security concern.
I can’t possibly think of any other solution for this problem and therefore have turned to this site for answering my question.
