PHPMailer advice

dcjones

Hi all.

After recently experiencing prolems with my web site been used to send SPAM, now resolved, I am considering using PHPmailer to send my users email from my site.

The question I have is:

Are there any known security isses with PHPmailer and if there are what are they.

Many thanks for any help nad advice you can offer.

NogDog

The new Version 2.0.0 release candidates include a fix for an input validation vulnerability (along with a bunch of new features).

dcjones

Hi NogDog,

Many thanks for your reply. You have advised and helped me in the past.

In your opinion is PHPMailer safe to use on my site providing I follow all the instructions correctly.

I can not afford any more security issues with my ISP.

Many thanks again.

NogDog

I have used PHPMailer (1.73 version) in a number of applications with no problems. But then, I never depended on it to filter any inputs, as I took on that responsibility myself. (The main thing is ensuring that any inputs being used in the mail() command for anything other than the actual message body do not contain any newlines and/or carriage returns.)

dcjones

Hi NogDog,

Thanks for your reply.

I will try PHPMailer out, its only going to be used by the administrator of my site so in theory I should not have a problem.

Many thanks again.

bradgrafelman

An alternative solution you might look at is called XPertMailer, which claims to offer "Protection against mail header injection."

I haven't used this package myself, but I've heard others say good things about it.