isSMTP(); $mail->Host = $cfg['smtp_host'] ?? ''; $mail->Port = (int)($cfg['smtp_port'] ?? 587); $secure = $cfg['smtp_secure'] ?? 'tls'; if ($secure === 'ssl') $mail->SMTPSecure = PHPMailer\PHPMailer\PHPMailer::ENCRYPTION_SMTPS; elseif ($secure === 'tls') $mail->SMTPSecure = PHPMailer\PHPMailer\PHPMailer::ENCRYPTION_STARTTLS; else $mail->SMTPSecure = false; $mail->SMTPAuth = true; $mail->Username = $cfg['smtp_user'] ?? ''; $mail->Password = $cfg['smtp_pass'] ?? ''; $fromEmail = $cfg['from_email'] ?? 'no-reply@localhost'; $fromName = $cfg['from_name'] ?? 'App'; $mail->setFrom($fromEmail, $fromName); // Use Reply-To for the user's email to avoid spoofing From if (filter_var($email, FILTER_VALIDATE_EMAIL)) { $mail->addReplyTo($email, $name ?: $email); } if (!empty($cfg['reply_to'])) { $mail->addReplyTo($cfg['reply_to']); } // Destination (adjust as needed) $mail->addAddress($fromEmail, $fromName); // DKIM (optional) if (!empty($cfg['dkim_domain']) && !empty($cfg['dkim_selector']) && !empty($cfg['dkim_private_key_path'])) { $mail->DKIM_domain = $cfg['dkim_domain']; $mail->DKIM_selector = $cfg['dkim_selector']; $mail->DKIM_private = $cfg['dkim_private_key_path']; } $mail->isHTML(true); $mail->Subject = $subject; $safeName = htmlspecialchars($name, ENT_QUOTES | ENT_SUBSTITUTE, 'UTF-8'); $safeEmail = htmlspecialchars($email, ENT_QUOTES | ENT_SUBSTITUTE, 'UTF-8'); $safeBody = nl2br(htmlspecialchars($body, ENT_QUOTES | ENT_SUBSTITUTE, 'UTF-8')); $mail->Body = "
Name: {$safeName}
Email: {$safeEmail}