更改从我的网站发送的电子邮件“匿名”

Question

I'm having an issue with a contact form. The email message is correctly sent but in my inbox appears as "From: [e-mail]" and not "From: [e-mail]", and goes directly to SPAM.

I've been looking for similar issues but no one gives the specific answer. I guess if the code is having a syntax mistake or it's a server problem.

This is the PHP file:

<?php
// Check for empty fields
if(empty($_POST['name']) || empty($_POST['email']) || empty($_POST['phone']) || empty($_POST['message']) || !filter_var($_POST['email'], FILTER_VALIDATE_EMAIL)) {
  http_response_code(500);
  exit();
}

$name = strip_tags(htmlspecialchars($_POST['name']));
$email = strip_tags(htmlspecialchars($_POST['email']));
$phone = strip_tags(htmlspecialchars($_POST['phone']));
$message = strip_tags(htmlspecialchars($_POST['message']));

// Create the email and send the message
$to = "[e-mail]"; 
$subject = "Mensaje Web de >> $name";
$body = "Recibiste mensaje a través del formulario en la web.
"."Estos son los datos:

Nombre y Apellido: $name

Email: $email

Teléfono: $phone

Texto del mensaje:
$message";
$headers= "From: [e-mail]" . "
" . 
    "Reply-To: $email 
" .
    'X-Mailer: PHP/' . phpversion(); 
if(!mail($to, $subject, $body, $headers))
  http_response_code(500);
?>

Does anyone figure out what's wrong here? Thank you,

Alejandra | aleare.design

Answer 1

It may solve your problem or not but it's always a good idea to set a proper sender address. In good old mail() that needs to be done with the $additional_parameters parameter and the syntax is -f followed by an email address with no display name:

mail($to, $subject, $body, $headers, '[e-mail]')

Additionally, make sure that your local SMTP server allows sending messages in the name of [e-mail]. If it doesn't, perhaps you need to get another server and make use of authentication, something that mail() doesn't allow.

In any case, it's really hard to get email right with this function since you need to do everything by yourself and email protocol is not trivial. For instance, I think your code is vulnerable to email headers injection. It's easier to just use a third-party library like Swift Mailer or PHPMailer.

P.S. What are you trying to accomplish with strip_tags(htmlspecialchars())? This will just make user input unreadable for not obvious gain.