If you’re not careful, sending email via PHP is about as safe as cookies at Fat Camp. BKWLD was recently tagged by a spammer who noticed one such insecurity on one of our websites and ended up using our server to send hundreds of emails. It wasn’t until MediaTemple informed us of this breach that we realized what had happened.
The method most spammers use is called a “mail injection”, in that the spammer manipulats the PHP mail() function via a custom form post, etc. I won’t go into details, as a quick search on Google came up with over 225,000 pages describing this technique – here are a few.
Getting around these hacks requires detailed validation of your data.Thankfully I’ve done everything for you using the best PHP email class around, PHPMailer. My class is called SendMail and it’s an extension of the PHPMailer class. The result is a powerful script capable of sending email via SMTP or POP3, all without handing over your server to a toothless spammer.
Read more »