What are the potential security risks associated with using the mail() function in PHP for sending emails from a contact form?

The potential security risks associated with using the mail() function in PHP for sending emails from a contact form include the possibility of injection attacks, where malicious users can exploit the form to send spam or execute arbitrary code. To mitigate these risks, it is recommended to sanitize and validate user input before using it in the mail() function. 

// Sanitize and validate user input before using it in the mail() function
$name = filter_var($_POST['name'], FILTER_SANITIZE_STRING);
$email = filter_var($_POST['email'], FILTER_VALIDATE_EMAIL);
$message = filter_var($_POST['message'], FILTER_SANITIZE_STRING);

// Check if email is valid
if ($email === false) {
    // Handle invalid email address
} else {
    // Send email using sanitized input
    $to = 'recipient@example.com';
    $subject = 'Contact Form Submission';
    $headers = 'From: ' . $email;
    
    // Use additional headers to prevent injection attacks
    $additional_headers = "MIME-Version: 1.0" . "\r\n";
    $additional_headers .= "Content-type:text/html;charset=UTF-8" . "\r\n";

    mail($to, $subject, $message, $headers, $additional_headers);
}

Keywords

mail() function security risks PHP contact form email sending

Related Questions