PHPmailer internal functions for validation/sanitazion vs external

Question

After searching for about a week for a good answer I realized that I had to ask for some help. I have been battling if I should use PHP-mailer or Swiftmailer for a week, I decided on PHP-mailer since I feel the documentation is more comprehensive and there are more examples out there. After looking in to the code, I found that PHP-mailer have many built in sanitation/validation functions. I wonder if any one seen any drawbacks or holes in them? How would you use them? To give the question a little more substance, do I wonder how you would validate/sanitize the following form data in a process.php file, using phpmailer. ```

Accepted Answer

Well, you can't use the code you've posted; it's an internal function in phpMailer that does stuff to the internal variables in the phpMailer object.

However, you can call the email address validation routine that is used by this code `ValidateAddress()` because it's a `public static` function.

So anywhere in your code, you should be able to call something like this:

```
$valid = phpMailer::ValidateAddress($email_address);
```

...and `$valid` will be set to `true` or `false` depending on whether its a valid address.

However, the point of the code in the question is that this is the code where PHPMailer sets its email addresses internally, and it is using `ValidateAddress()` itself. This means that phpMailer is already doing the validation whenever you give it an email address. You don't really need to validate it youself first because phpMailer will do it for you anyway.

What you do need to do is trap any errors that phpMailer might throw back at you as a result of valdation errors. By default it simply returns `false` if functions fail, so you can check for that. Alternatively, you can switch on its exceptions mode and use `try...catch` to pick up exceptions that it throws.

Either way, the point is that phpMailer is designed to be secure by default; it won't accept bad email addresses or other invalid data. So your question isn't really necessary; just give phpMailer the data, and it will do the validation for you.

(That's not to say phpMailer is perfect code; it's possible that someone may find a security hole in it, just as it's possible with any other software, but as long as you make sure to keep up-to-date with patch releases, that shouldn't be an issue)

PHPmailer internal functions for validation/sanitazion vs external

Solution

Problem