How to Send Email from an HTML Contact Form

What does this code mean?
First we check if the message was filled and if it is, the code inside IF will execute, effectively launching mail( ) function. "mail" sends the completed form as an email to "[email protected]," and the subject line is what follows.

With that, we have the really really basic code, without any validation or security checks, surely we can do better than this.

Now remember that we have input HTML elements in our form right? Every one of the fields we want to process, has a parameter name to it and we will work with those in sendmail.php. Data filled by a user will be converted into a variable with that name from which input it came. For this to work, of course the name parameters need to have unique ‘names’, note that we have only one of each - name=”name”, name=”email”, name=”message” , etc.
As we spoke these variables are all packed in a PHP superglobal variable called $_POST . If you add this to the sendmail.php, upon filling the form, you should see the data that are being submitted.

";
    print_r($_POST);
echo "

Now we set some variables to break out the $_POST to work with the data. Now we have our code like this>

if($_POST["message"]) {
    $name = $_POST["name"];
    $visitorEmail = $_POST["email"];
    $message = $_POST["message"];
    $OUR_MAIL = '[email protected]';
    
$errors = "";
//NORMAL OPERATION - NO ERRORS        
    if(empty($errors)){
        $EMAIL_SUBJECT = "New Form Contact From " . $name . " @ Your Portfolio Website!";
        $emailBody = "User name: " . $name . "rn".
                     "User email: " . $visitorEmail . "rn".
                     "User message: " . $message . "rn";
 
        $TARGET_EMAIL = "[email protected]";
//HEADERS
        $headers = "From: " . $OUR_MAIL . "rn";
        $headers .= "Reply-To: " . $visitorEmail . "rn";
}}
?>

(Note: rn will do the line break - the line structured text)
For now, we don't have any code validation, nor actual mail function, but that is going to change as we show it in the code next. Headers are optional, serve for things like BCC, Reply-To addresses, and things like that.

Mail Function

PHP mail is the built in PHP function that is used to send emails from PHP scripts.

mail($TARGET_EMAIL, $EMAIL_SUBJECT, $emailBody, $headers)

We added resolution of success or failure of the mail function, it will even show the user message according to what is the result. Last thing will be the redirection to the index.html page, effectively refreshing the window.

$success = mail($TARGET_EMAIL, $EMAIL_SUBJECT, $emailBody, $headers);
//SUCCESS OR FAIL FOR CORRECT TEXT
if ($success){
        ?>
      
      
      
      









XAMPP settings



If you for some reason see this message - Failed to connect to mailserver at “localhost”.. , now we will give you some hints on how to resolve this issue.



PHP must be configured correctly in the php.ini file with the details of how your system sends email.

Open php.ini file in XAMPP directory and find the section headed [mail function].



Windows users should ensure that the directive called SMTP that defines your email server address is set to the SMTP = smtp.gmail.com . The second is called sendmail_from which defines your own email address, so that one you need to set to the gmail address EXACTLY like we have $OUR_MAIL variable.



Another important thing is to configure sendmail.ini for email notifications. In PHP.ini locate sendmail_path and replace it with sendmail_path = ""C:xamppsendmailsendmail.exe" -t" . Obviously the drive and path must be pointing to the sendmail.exe, be sure it is.



Edit the sendmail.ini file in the sendmail subdirectory of your XAMPP installation directory. Inside this file, find the [sendmail] section and replace these lines. The values should be like this>

Smtp_server = smtp.gmail.com

Smtp_port = 465

Smtp_ssl = auto

Error_logfile = error.log

Auth_username = [email protected]

Auth_password = gmail password 

After this, restart the Apache server using the XAMPP control panel.



Gmail Email Client

Also as the last advice, using Gmail SMTP server for sending emails works only if you have allowed less secure apps  to access your account(If you don't use 2-Step Verification).

And in settings enable IMAP access.



Validate Form Data With PHP



Were almost at the end. The thing is, we might be victims of some malevolence everytime we put any form out there, we might have to have more security set up. Lets focus on the back-end, about how to validate HTML forms we wrote in the other article, there you can get information on how to do the Javascript front-end code.

So we modify yet again our code. Remember we have our code checking for errors but they haven't been captured yet. Now only when no errors exist the code will proceed to mail()  function.

//EMPTY SPACE VALIDATION
    if(empty($name) || empty($visitorEmail) || empty($message)){
        $errors .= "n All fields are required";
    }
 
    //NAME VALIDATION
    $string_exp = "/^[A-Za-z .'-]+$/";
    if (!preg_match($string_exp, $name)) {
        $error_message .= "n The Name you entered does not appear to be valid.";
    }
 
    //EMAIL REGEX VALIDATION
    $email_exp = "/^[_a-z0-9-]+(.[_a-z0-9-]+)*@[a-z0-9-]+(.[a-z0-9-]+)*(.[a-z]{2,3})$/i";
    if (!preg_match($email_exp, $visitorEmail)){
        $errors .= "n Invalid email address";
    }








Good, so far we have validation IF the user submitted the form, and we have validation if there are missing fields or data we don't want. Next we need to get rid of potencial exploits from cross-site scripting(XSS), we must prevent attackers from injecting client-side script into our code.


	
Strip unnecessary characters (extra space, tab, newline) from the user input data (with the PHP trim()  function), we also get rid of HTML tags in this one step.
	
Remove backslashes () from the user input data (with the PHP stripslashes() function)
	
By using the htmlspecialchars() this function will convert the special characters into entities to prevent browsers from using it as an HTML elements. This is useful to prevent code from running when we want to do so, for example if the user tries to submit or run his code put in the text field. This doesn't delete the characters, but they won't be handled as HTML code anymore, but as plain text.
	

	will become:  

	
<script>location.href('http://www.facebook.com')</script>
	 .
	
Lastly we defined a function to replace the empty character of all the unnecessary text we don't want to appear in our mailbox, note that we moved all the text to lowercase for this.


Now, we can check all the incoming data (all our form fields) which we are writing to variables with the test_input()  function, and with the function we will strip the data from potentially harming hacker attempts.



//TEST INPUT DATA FOR INJECTION
function testInputData($data){
  $data = strip_tags(trim($data));    //trim extra space, tab, newline from the user input data
  $data = stripslashes($data);        //Remove backslashes () from the user input data
  $data = htmlspecialchars($data);    //data would be saved as HTML escaped code, so safe to display
  $data = preg_replace("([rn])", "", $data); //removes newlines
  $data = cleanString(strtolower($data));      //removing unwanted strings
return $data;
}
 
//Returns empty if encounters any unwanted characters in $inputString
function cleanString($inputString){
  $unwantedChars = array("content-type", "bcc:", "to:", "cc:", "href", "https");
  return str_replace($unwantedChars, "", $inputString);
}


//SEND MAIL CODE
    $name = testInputData($_POST["name"]);
    $visitorEmail = testInputData($_POST["email"]);
    $message = testInputData($_POST["message"]);


PHPMailer



Lets talk about why PHPMailer is better than native PHP mail.



PHPMailer is perhaps the most popular open-source PHP library for sending emails and since its release it has become a PHP developer’s favorite. It is an alternative to PHP mail()  function, but with more flexibility for your needs. For instance PHPMailer is object oriented, it can use a non-local mail SMTP server, which is better than mail()s local mail server, it can print error messages when email sending fails. And is also used by popular PHP CMS (content management systems) like WordPress, Drupal, and Joomla.



So we need to go to PHPMailer Github repository and download it as a zip file.

Extract and put files from the src directory of the archive to our application directory to the ‘mail’ folder.



To illustrate how it can be used with our Gmail account, we create totally different script named sendmailphpmailer.php, link it in the index.html instead of sendmail.php and we add this code inside>

isSMTP();
//Send using SMTP
$mail->SMTPDebug  = 0;
//0 = off(for production use)/1 = client messages/2 = client and server messages
$mail->Host       = 'smtp.gmail.com';                       
//Set the SMTP server to send through
//$mail->Host = gethostbyname('smtp.gmail.com');              
//if your network does not support SMTP over IPv6
$mail->SMTPSecure = 'tls';                                  
// ssl is deprecated
$mail->SMTPAuth   = true;                                   
//Enable SMTP authentication
$mail->SMTPSecure = PHPMailer::ENCRYPTION_STARTTLS;         
//Enable TLS encryption; `PHPMailer::ENCRYPTION_SMTPS` encouraged
$mail->Port       = 587;                                    
//TCP port to connect to, use 465 for `PHPMailer::ENCRYPTION_SMTPS` above
$mail->SMTPOptions = array(
    'ssl' => array(
    'verify_peer' => false,
    'verify_peer_name' => false,
    'allow_self_signed' => true
    )
);
 
//AUTHENTIFICATION
$mail->Username   = '[email protected]';     //SMTP username
$mail->Password   = 'websiteGmailAccountPassword';           //SMTP password
 
//RECIPIENTS
$mail->setFrom('[email protected]', 'Tibor Kopca Portfolio');        
//From email and name
$mail->addAddress("[email protected]", "Recipient : Tibor Kopca");           
//To address and name
$mail->addReplyTo($visitorEmail, "Reply to " . $name );                          
//Address to which recipient will reply
 
//CC and BCC
//$mail->addCC("[email protected]");
$mail->addCC($visitorEmail, $name);                      
//carbon copy to visitor email address
$mail->addBCC('[email protected]');
 
//CONTENT
$mail->isHTML(false);                                                              
//Send HTML or Plain Text email
$mail->Subject = "New Form Contact From " . $name . " @ Your Portfolio Website!";
$mail->AltBody = "This is the plain text version of the email content";    
// If html emails is not supported by the receiver, show this body
$mail->msgHTML("
Thank you for the message. We will contact you shortly.
 
" .
                "
User name: " . $name . " 
" .
                "User email: " . $visitorEmail . "
" .
                "User message: " . $message . "
" );
 
//ERROR HANDLING AND SEND MAIL
if ($errors) {
//error messages exists - the message shouldnt be send
    echo "Mailer Error: " . $errors;
}else{
    try {
        $mail->send();
        ?>
        
        ErrorInfo; //can return error messages in 43 different languages.
        ?>
        
        












Note2: at the end we modified the redirection to our index.html with some extra code to pass the content we want in the URL. This way we can catch that content in the page we are going to be redirected. For this to work, we renamed index.html to index.php and we added this code where the HTML form element is. Basically when the message runs successfully, form won't appear again but the message we coded instead.


   
Thank you for the message, I will respond ASAP.
Message failed. Please, contact me by an alternative way.

          
          
          
          
          
          
   



And this will be the result when all would run correctly.



JavaScript Form Validation



We advise you to also add frontend form validation, because in this article we did not show any. If you want to know how it could be made, that we covered in our other article.



Conclusion



And that’s it! We covered PHP built in mail() function and PHPMailer library as an alternative.

To this subject there is much more to be learned but hopefully in this tutorial we provided the basics of sending emails from your website form.

Next time we’d write about how to implement Whatsapp messenger to our website, so stay tuned.



Main Image by M. H. from Pixabay,

Images and editing by Tibor Kopca