Hacker News Reader

Comment by jexyru | Hacker News Reader

This discussion is broken by design. Using user input from contact form as "From" address for emails, sent from your site, is the mistake of your application - you should use something like "noreply@yoursite.com", why you put user email there? In addition - most probably such emails will not pass spam filters.

View on HN

It depends on whether you want to follow RFCs or not. Particularly, RFC 4021 [1] states that:

  Header Field: From

      Specifies the author(s) of the message; that is, the mailbox(es)
      of the person(s) or system(s) responsible for the writing of the
      message.  Defined as standard by RFC 822.

  Header Field: Sender

      Specifies the mailbox of the agent responsible for the actual
      transmission of the message.  Defined as standard by RFC 822.

As far as I understand, this means that yes, you should set the From address to the user's email when sending content submitted by that user. In contrast, you should never set the Sender address to any user's email.

Another discussion is whether this is sensible or not, how well it works delivery-wise, etc... In any case, it is not as clear-cut as you make it seem.

[1] https://tools.ietf.org/html/rfc4021#section-2.1.2

Right, whenever using mail() even without PHPMailer or anything for a basic form I've always thought it was best to set it to something like the following

  $headers = "From: noreply@yourwebsite.com\n";

If you want to be able to reply to the email you can still set it with something like

  $headers .= "Reply-To: $email_address";

Then in your content body you could also include your $email_address variable.

You would probably want to respond to the user, and it is possible only if they give you their email in the form. Although, this can be solved by treating the From field in the mail form as just a field of information and have that in the body of email. But that would make automated replies difficult.

you could use reply-to header instead of from, being another additional header i guess it has the same problem.

Reply on news.ycombinator.com