I have been in conversation with a fellow web developer on whose servers I am doing some client work. Part of the current project is to add an email sending system from a web based form to my clients email via PHPMailer.
I have used PHPMailer repeatedly with no issues whatsoever, however, this developer has said to me that they do not want PHPMailer on the server due to having found previous instances on their server of PHPMailer being 'hacked'.
Please note that with all form to email systems I use I do believe I fully escape and clean the input strings as far as possible.
I'm asking here:
- Is hacking PHPMailer version 5.2.8 specifically even possible?
- How is this possible?
- What can be done to secure PHPMailer in these instances?
Is there a halfway clear way that the above script could be hacked or otherwise hijacked by a hacker or similar?
Please note: all $member
array values are from a database and have already been pre-cleaned.
require "PHPMailerAutoload.php"; ///version 5.2.8
$message = "The following enquiry about " . $member['bizname'] . " was sent to " . $member['contname'] . " :
Enquirer's Name: " . $name . ",
Enquirer's Address:
" . $addr1 . "
" . $addr2 . "
" . $addr3 . "
" . $postcode . "
Telephone Number: " . $tel . ",
Email address: " . $email . ",
Dates they are interested in: " . $dates . ",
Comments: " . $comments . ".
NOTE: This is an automatic notification email for your records.
Please do not reply to this email.
";
$mail = new PHPMailer();
$mail->Host = "localhost";
$mail->WordWrap = 78;
$mail->Mailer = "smtp";
$mail->From = "server@website.co.uk";
$mail->FromName = "Website Server";
///this is the client email and would not change.
$mail->AddAddress("static@email-address.co.uk");
$mail->Subject = $member['bizname'] . " Website Enquiry";
$mail->Body = $message;
if (!$mail->Send()) {
$dispmsg = "Mailer 1 error: " . $mail->ErrorInfo;
} else {
$dispmsg = "Your email has been sent to " . $member['bizname'] . " who will be in touch with you shortly.";
}
////////////end email 1