Secure PHP SendMail - php

Question

So this is my first post, I try to tell what my issue's are.
I have bought a domain name that I want to sell.
So I code a simple HTML website with some CSS stuff.
OK. I also have a form in my HTML, that contains this:
<input type="text" placeholder="Amount" name="amount">
<input type="text" placeholder="Name" required name="name">
<input type="text" placeholder="Email Address" required name="email">
<div class="validation">
<button class="btn" name="submit">Send request</button>
$email_to = "email#email.com";
$amount = $_POST["amount"];
$name = $_POST["name"];
$email = $_POST["email"];
$email_subject = "Domeiname";
$headers = "From: " . $email . "\n";
$headers .= "Reply-To: " . $email . "\n";
ini_set("sendmail", $email);
$sent = mail($email_to, $email_subject, $amount, $headers, "-f" .$email);
if ($sent)
{
header("Location: https:mywebsite.com");
} else {
echo "There has been an error sending your comments. Please try later.";
}l
It's working and I receive emails. So my question is, is it safe? Is it vulnerable to hackers?
(I also receive in my Gmail, that this email can be spam/not from me).
Am I doing something wrong?
EDIT: Found another issue: In my email, I only receive the "amount" status and not the "name + email".

Answer 1

There are a number of libraries that will take all the hard work of securely sending email from you - such as swiftmailer.
<?php
require_once 'lib/swift_required.php';
// Sendmail
$transport = Swift_SendmailTransport::newInstance('/usr/sbin/sendmail -bs');
// Create the Mailer using your created Transport
$mailer = Swift_Mailer::newInstance($transport);
// Create a message
$message = Swift_Message::newInstance('Wonderful Subject')
->setFrom(array('john#doe.com' => 'John Doe'))
->setTo(array('receiver#domain.org', 'other#domain.org' => 'A name'))
->setBody('Here is the message itself')
;
// Send the message
$result = $mailer->send($message);
You may also find it very valuable to sign up for a service such as Mailgun and also setup your code to use their servers to actually send the email (there are libraries would setup as a 'transport' to send the message to them via HTTP, and then they email it to the final destination). There are a number of such 'ESP' (Email Service Providers), and many offer a substantial free-tier, so it won't cost you anything for even thousands of emails per month.

Answer 2

It looks as though you are sending an E-mail when a form is submitted. This is perfectly secure; there is no way a hacker could manipulate who the E-mail gets sent to; PHP is server-side code. Thus, $email_to = "email#email.com"; cannot get manipulated from the form itself, as it is hard-coded into your PHP.
Obviously, the $_POST data variables get passed through from the form, so their contents can be manipulated by the form -- though this is required in order for you to be able to retrieve the visitor's name and E-mail address.
PHPMailer did have a recent vulnerability in it, where an attacker could breach your website by entering a certain 'From' E-mail address, but this has since been patched. You still need to allow the user to enter their E-mail address, or you won't know who to reply to.
However, a user would still be able to create additional headers based on you not validating that the 'From' address is an actual valid E-mail address. You should validate this, and only send the E-mail if it is found to be valid:
if (!filter_var($email, FILTER_VALIDATE_EMAIL) === false) {
$sent = mail($email_to, $email_subject, $amount, $headers, "-f" .$email);
}
Note that you're also not actually doing anything with the $name variable. Assuming you're trying to make it display the person's name in the 'FROM' field in the E-mail, you need to pass it as:
$headers = "From: " . $name . " <" . $email . ">\n";
So that it gets rendered as From: Person <email#email.com>.
Hope this helps! :)