Secure php email script

Question

I want to use a php script to send emails from a html file on a website. Would this php script be secure enough against hacking and spam?

<?php 

$to = "[email protected]";
$subject = "Sent from site";

$email = $_POST['emailFrom'];
$message = $_POST['message'];

$email   = filter_var($email , FILTER_SANITIZE_EMAIL);
$message = filter_var($message , FILTER_SANITIZE_EMAIL);

$message = $email . $message;

mail($to, $subject, $message, "From: [email protected]");
?>

Looks good. As long as anything that can be posted is checked, you are on the safe side. — Olaf
– Olaf, Commented Mar 7, 2012 at 17:30
As long as your script does not let someone specify their own recipient address, it will not be useful for spammers. — ghoti
– ghoti, Commented Mar 7, 2012 at 17:31

mjsa · Accepted Answer · 2013-11-30 14:58:53Z

1

FILTER_SANITIZE_EMAIL removes illegal email address characters from a string; this is, therefore not the best option for the contents of an email (however useful it may be for email addresses). Whilst removing HTML special characters is useful when preventing XSS attacks, it is worth noting that there are legitimate reasons to post < and > in messages (i.e. right now). Therefore it is better to convert these characters to their html entities.

I.e.
< would become <
and > would become >

So in order to change html characters to their entities replace:
$message = filter_var($message , FILTER_SANITIZE_EMAIL); with
$message = htmlspecialchars($message);
Other than that it looks good; but remember, in cases where a database is involved database sanitisation should also be added.

answered Nov 30, 2013 at 14:58

mjsa

4,4291 gold badge28 silver badges35 bronze badges

Sign up to request clarification or add additional context in comments.

Collectives™ on Stack Overflow

Secure php email script

1 Answer 1

Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related