What potential pitfalls should be considered when sending form data via email using PHP?

When sending form data via email using PHP, it is important to consider potential security risks such as injection attacks or exposing sensitive information in the email body. To mitigate these risks, it is recommended to sanitize and validate the form data before including it in the email content. Additionally, it is best practice to use a secure email transport method such as SMTP with authentication to send the email. 

// Sanitize and validate form data
$name = filter_var($_POST['name'], FILTER_SANITIZE_STRING);
$email = filter_var($_POST['email'], FILTER_VALIDATE_EMAIL);
$message = filter_var($_POST['message'], FILTER_SANITIZE_STRING);

// Set up email headers
$to = "recipient@example.com";
$subject = "Contact Form Submission";
$headers = "From: $name <$email>";

// Send email using SMTP with authentication
$transport = (new Swift_SmtpTransport('smtp.example.com', 587, 'tls'))
  ->setUsername('username')
  ->setPassword('password');

$mailer = new Swift_Mailer($transport);

$message = (new Swift_Message($subject))
  ->setFrom([$email => $name])
  ->setTo($to)
  ->setBody($message);

$result = $mailer->send($message);

if($result) {
  echo "Email sent successfully";
} else {
  echo "Failed to send email";
}

Keywords

email form data security validation injection

Related Questions