How to Prevent Malicious Input in Email Transmission with PHP?

Securing User Input for Email Transmission

In PHP, it's imperative to sanitize user input before sending emails to prevent malicious or harmful content from compromising your system. Consider the code snippet below for a simple PHP mailer script:

<code class="php"><?php
$to = "[email protected]";

$name = $_POST['name'];
$message = $_POST['message'];
$email = $_POST['email'];

$body = "Person $name submitted a message: $message";
$subject = "A message has been submitted";

$headers = 'From: ' . $email;

mail($to, $subject, $body, $headers);

header("Location: http://example.com/thanks");
?></code>

To protect against malicious input, sanitize the user input using PHP's filter_var() function. By applying the FILTER_SANITIZE_EMAIL filter, you can ensure that the email address is in a valid format and remove potential malicious characters.

<code class="php">echo filter_var($_POST['email'], FILTER_SANITIZE_EMAIL);</code>

By implementing this sanitization, you can prevent vulnerabilities such as injection attacks and ensure that only trusted input is transmitted via email.

The above is the detailed content of How to Prevent Malicious Input in Email Transmission with PHP?. For more information, please follow other related articles on the PHP Chinese website!