What are the potential pitfalls of using PHPMailer with an HTML form?

One potential pitfall of using PHPMailer with an HTML form is the risk of email injection attacks if user input is not properly sanitized. To prevent this, always validate and sanitize user input before passing it to PHPMailer for sending emails. Additionally, make sure to set the "From" address in the email header to a trusted email address to prevent spoofing. 

// Sanitize user input before passing it to PHPMailer
$name = filter_var($_POST['name'], FILTER_SANITIZE_STRING);
$email = filter_var($_POST['email'], FILTER_SANITIZE_EMAIL);
$message = filter_var($_POST['message'], FILTER_SANITIZE_STRING);

// Set the "From" address to a trusted email address
$mail->setFrom('your_email@example.com', 'Your Name');

// Use the sanitized user input in the email body
$mail->Body = "Name: $name\n";
$mail->Body .= "Email: $email\n";
$mail->Body .= "Message: $message\n";

// Send the email
if(!$mail->send()) {
    echo 'Message could not be sent.';
    echo 'Mailer Error: ' . $mail->ErrorInfo;
} else {
    echo 'Message has been sent';
}

Keywords

PHPMailer HTML form potential vulnerabilities email injection cross-site scripting

Related Questions