What best practices should be followed when handling form submissions and sending emails in PHP, particularly in the context of a ticket system?

When handling form submissions and sending emails in PHP, particularly in the context of a ticket system, it is important to sanitize and validate user input to prevent SQL injection and cross-site scripting attacks. Additionally, always use prepared statements when interacting with a database to prevent SQL injection. When sending emails, make sure to properly sanitize and validate email addresses to prevent header injections and spam. Implementing these best practices will help secure your application and ensure the integrity of user data. 

// Sanitize and validate form input
$name = filter_var($_POST['name'], FILTER_SANITIZE_STRING);
$email = filter_var($_POST['email'], FILTER_VALIDATE_EMAIL);
$message = filter_var($_POST['message'], FILTER_SANITIZE_STRING);

// Validate email address
if (!filter_var($email, FILTER_VALIDATE_EMAIL)) {
    // Handle invalid email address
}

// Use prepared statements to interact with database
$stmt = $pdo->prepare("INSERT INTO tickets (name, email, message) VALUES (?, ?, ?)");
$stmt->execute([$name, $email, $message]);

// Send email
$to = 'support@example.com';
$subject = 'New ticket submitted';
$body = "Name: $name\nEmail: $email\nMessage: $message";
$headers = 'From: support@example.com';

if (mail($to, $subject, $body, $headers)) {
    echo 'Email sent successfully';
} else {
    echo 'Email sending failed';
}

Keywords

form submissions email sending PHP ticket system validation

Related Questions