What are the potential security risks of using user input directly in the "From" field of an email sent through PHP?

Using user input directly in the "From" field of an email sent through PHP can lead to email spoofing, where malicious users can impersonate others by manipulating the sender's email address. To mitigate this risk, it is recommended to set a fixed email address as the sender and use the user input as the reply-to address instead. 

$from = "noreply@example.com";
$replyTo = $_POST['user_email'];

$headers = "From: $from" . "\r\n" .
           "Reply-To: $replyTo" . "\r\n" .
           "X-Mailer: PHP/" . phpversion();

mail($to, $subject, $message, $headers);

Keywords

PHP email injection cross-site scripting validation security vulnerability

Related Questions