Skip to content
PHP Logo

Are there any security considerations to keep in mind when implementing a formmail script in PHP?

When implementing a formmail script in PHP, it is important to consider security measures to prevent potential vulnerabilities such as email injection attacks. One way to mitigate this risk is by validating and sanitizing user input before sending the email. This can be done by using PHP's built-in filter_var function with the FILTER_SANITIZE_EMAIL filter to ensure that the input is a valid email address.

php 
// Validate and sanitize email input
$email = filter_var($_POST['email'], FILTER_SANITIZE_EMAIL);

// Check if email is valid
if (filter_var($email, FILTER_VALIDATE_EMAIL)) {
    // Send email
    mail('recipient@example.com', 'Subject', 'Message', 'From: ' . $email);
} else {
    // Handle invalid email address
    echo 'Invalid email address';
}

Related questions