Php ini mail function

For the mail functions to be available, PHP requires an installed and working email system. The program to be used is defined by the configuration settings in the php.ini file.

Installation

The mail functions are part of the PHP core. There is no installation needed to use these functions.

Runtime Configuration

The behavior of the mail functions is affected by settings in php.ini:

NameDefaultDescriptionChangeablemail.add_x_header"0"Add X-PHP-Originating-Script that will include UID of the script followed by the filename. For PHP 5.3.0 and abovePHP_INI_PERDIRmail.logNULLThe path to a log file that will log all mail() calls. Log  include full path of script, line number, To address and headers. For PHP 5.3.0 and abovePHP_INI_PERDIRSMTP"localhost"Windows only: The DNS name or IP address of the SMTP serverPHP_INI_ALLsmtp_port"25"Windows only: The SMTP port number. For PHP 4.3.0 and abovePHP_INI_ALLsendmail_fromNULLWindows only: Specifies the "from" address to be used when sending mail from mail()PHP_INI_ALLsendmail_path"/usr/sbin/sendmail -t -i"Specifies where the sendmail program can be found. This directive works also under Windows. If set, SMTP, smtp_port and sendmail_from are ignoredPHP_INI_SYSTEM

Configuring SMTP settings on your localhost Assuming you are using xampp on windows, locate the “php.ini” in the directory “C:\xampp\php”.

• Open it using notepad or any text editor. We will use notepad in this example. Click on the edit menu

• Click on Find… menu

• The find dialog menu will appear

• Click on Find Next button

• Locate the entries
  • [mail function]
  • ; XAMPP: Don’t remove the semi column if you want to work with an SMTP Server like Mercury
  • ; SMTP = localhost
  • ; smtp_port = 25
  • Remove the semi colons before SMTP and smtp_port and set the SMTP to your smtp server and the port to your smtp port. Your settings should look as follows
    • SMTP = smtp.example.com
    • smtp_port = 25
    • Note the SMTP settings can be gotten from your web hosting providers.
    • If the server requires authentication, then add the following lines.
      • auth_username = [email protected]
      • auth_password = example_password
      • Save the new changes.
      • Restart Apache server.

PHP Mail Example

Let’s now look at an example that sends a simple mail.

<?php     
$to_email = 'name @ company . com';
$subject = 'Testing PHP Mail';
$message = 'This mail is sent using the PHP mail function';
$headers = 'From: noreply @ company . com';
mail($to_email,$subject,$message,$headers);
?>

Output:

Note: the above example only takes the 4 mandatory parameters.

You should replace the above fictitious email address with a real email address.

Sanitizing email user inputs

The above example uses hard coded values in the source code for the email address and other details for simplicity.

Let’s assume you have to create a contact us form for users fill in the details and then submit.

• Users can accidently or intentional inject code in the headers which can result in sending spam mail
• To protect your system from such attacks, you can create a custom function that sanitizes and validates the values before the mail is sent.

Let’s create a custom function that validates and sanitizes the email address using the filter_var built in function.

Filter_var function The filter_var function is used to sanitize and validate the user input data.

It has the following basic syntax.

<?php
filter_var($field, SANITIZATION TYPE);
?>

HERE,

• “filter_var(…)” is the validation and sanitization function
• “$field” is the value of the field to be filtered.
• “SANITIZATION TYPE” is the type of sanitization to be performed on the field such as;
  • FILTER_VALIDATE_EMAIL – it returns true for valid email addresses and false for invalid email addresses.
  • FILTER_SANITIZE_EMAIL – it removes illegal characters from email addresses. info\@domain.(com) returns [email protected].
  • FILTER_SANITIZE_URL – it removes illegal characters from URLs. http://[email protected]é returns >http://[email protected]
  • FILTER_SANITIZE_STRING – it removes tags from string values. <b>am bold</b> becomes am bold.

The code below implements uses a custom function to send secure mail.

<?php 
function sanitize_my_email($field) {
    $field = filter_var($field, FILTER_SANITIZE_EMAIL);
    if (filter_var($field, FILTER_VALIDATE_EMAIL)) {
        return true;
    } else {
        return false;
    }
}
$to_email = 'name @ company . com';
$subject = 'Testing PHP Mail';
$message = 'This mail is sent using the PHP mail ';
$headers = 'From: noreply @ company. com';
//check if the email address is invalid $secure_check
$secure_check = sanitize_my_email($to_email);
if ($secure_check == false) {
    echo "Invalid input";
} else { //send email 
    mail($to_email, $subject, $message, $headers);
    echo "This email is sent using PHP Mail";
}
?>

Output:

Secure Mail

Emails can be intercepted during transmission by unintended recipients.

This can exposure the contents of the email to unintended recipients.

Secure mail solves this problem by transmitting emails via Hypertext Transfer Protocol Secure (HTTPS).

How to enable mail () function in PHP?

What is the mail () function in PHP?

How to use Ini_set for mail in PHP?

How to change SMTP settings in PHP ini?