Please do not put this code into production

OK. So there are many things wrong with the code that need fixing before we can even begin to answer your question.

1. Firstly we’re using $_REQUEST without good reason — $_REQUEST gives us access to all of the information sent in the request, which means that $_POST['foo'] $_REQUEST['foo'] === $_GET['foo'] and also $_COOKIE['foo']! That means that we are able to request ID’s from your application simply by setting a cookie locally.

2. Secondly, we are taking $post_id and doing this with it:

   $post_id = $_REQUEST[‘postID’];
   …
   $page = get_post($post_id);

Which means that, once we scrutinise the code for [get_post](https://developer.wordpress.org/reference/functions/get_post/) and find that it does no checks for any access rights it means that you are now allowing the user (who you do not know) to get any single ‘post’ which you have on your website. As WordPress stores all post-like objects in the table wp_posts it means that if you use WordPress post types for any kind of protected information, then the user will be able to access this information (in theory) simply by requesting it.

3. Thirdly, we are passing an unfiltered variable into a function a la $intro = get_post_meta($post_id, $key = 'podcast_file', true); – thankfully WordPress filters this input for us

4. Fourthly, we then send the return value of this, unchecked to create another variable $path = str_replace("http://com.areonline.co.uk/wp-content","",$intro);

5. Fifthly we then use this($path) variable and email it as an attachment to the sender!!!

---

Other than that, try sending your request using jQuery.post and also consider creating localised variables using Localize Script and (to answer the question) also use event.preventDefault() on whatever you don’t want to happen.

In this case:

$("#UniqueLevelEmailButton").click(function(e){
    e.preventDefault();
    // blah
}

---