SMTPDebug = 2; // Enable verbose debug output // $mail->Debugoutput = 'html'; $mail->isSMTP(); $mail->Host = $cfg['smtp_host'] ?? ''; $mail->Port = (int)($cfg['smtp_port'] ?? 587); $secure = $cfg['smtp_secure'] ?? 'tls'; if ($secure === 'ssl') $mail->SMTPSecure = PHPMailer\PHPMailer\PHPMailer::ENCRYPTION_SMTPS; elseif ($secure === 'tls') $mail->SMTPSecure = PHPMailer\PHPMailer\PHPMailer::ENCRYPTION_STARTTLS; else $mail->SMTPSecure = false; $mail->SMTPAuth = true; $mail->Username = $cfg['smtp_user'] ?? ''; $mail->Password = $cfg['smtp_pass'] ?? ''; $fromEmail = $cfg['from_email'] ?? 'no-reply@localhost'; $fromName = $cfg['from_name'] ?? 'App'; $mail->setFrom($fromEmail, $fromName); // Use Reply-To for the user's email to avoid spoofing From if (filter_var($email, FILTER_VALIDATE_EMAIL)) { $mail->addReplyTo($email, $name ?: $email); } if (!empty($cfg['reply_to'])) { $mail->addReplyTo($cfg['reply_to']); } // Destination: prefer dynamic recipients ($to), fallback to MAIL_TO, then MAIL_FROM $toList = []; if ($to) { if (is_string($to)) { // allow comma-separated list $toList = array_map('trim', explode(',', $to)); } elseif (is_array($to)) { $toList = $to; } } elseif (!empty(getenv('MAIL_TO'))) { $toList = array_map('trim', explode(',', getenv('MAIL_TO'))); } $added = 0; foreach ($toList as $addr) { if (filter_var($addr, FILTER_VALIDATE_EMAIL)) { $mail->addAddress($addr); $added++; } } if ($added === 0) { // Final fallback: send to FROM address $mail->addAddress($fromEmail, $fromName); } // DKIM (optional) if (!empty($cfg['dkim_domain']) && !empty($cfg['dkim_selector']) && !empty($cfg['dkim_private_key_path'])) { $mail->DKIM_domain = $cfg['dkim_domain']; $mail->DKIM_selector = $cfg['dkim_selector']; $mail->DKIM_private = $cfg['dkim_private_key_path']; } $mail->isHTML(true); $mail->Subject = $subject; $safeName = htmlspecialchars($name, ENT_QUOTES | ENT_SUBSTITUTE, 'UTF-8'); $safeEmail = htmlspecialchars($email, ENT_QUOTES | ENT_SUBSTITUTE, 'UTF-8'); $safeBody = nl2br(htmlspecialchars($body, ENT_QUOTES | ENT_SUBSTITUTE, 'UTF-8')); $mail->Body = "
Name: {$safeName}
Email: {$safeEmail}