What are the potential security risks associated with using PHP mail() function for sending form data?

Using the PHP mail() function to send form data can pose security risks such as email header injection, which can allow malicious users to manipulate the email headers and potentially send spam or phishing emails. To mitigate this risk, it is recommended to sanitize and validate user input before using it in the mail() function. 

// Sanitize and validate user input before using it in the mail() function
$name = filter_var($_POST['name'], FILTER_SANITIZE_STRING);
$email = filter_var($_POST['email'], FILTER_VALIDATE_EMAIL);
$message = filter_var($_POST['message'], FILTER_SANITIZE_STRING);

// Use additional headers to prevent email header injection
$subject = 'Contact Form Submission';
$headers = 'From: ' . $email . "\r\n" .
           'Reply-To: ' . $email . "\r\n" .
           'X-Mailer: PHP/' . phpversion();

// Send the email using the sanitized and validated input
mail('recipient@example.com', $subject, $message, $headers);

Keywords

PHP mail() function security risks form data vulnerabilities

Related Questions