PHP邮件配置错误排查：AWS EC2网站联系表单问题

Let's break down the problems in your provided code snippet, along with key considerations for your EC2 + GoDaddy setup:

1. Critical XSS Vulnerability #

Your code directly injects user input ($name, $email) into JavaScript alert calls without escaping:

echo "<script type='text/javascript'>alert('$name')</script>";

If a user submits input like '); document.location.href='malicious-site.com'; //, this will execute arbitrary code in the visitor's browser—this is a classic cross-site scripting (XSS) risk.

Fix: Use htmlspecialchars() to escape user input before inserting it into HTML/JS contexts:

$safeName = htmlspecialchars($name, ENT_QUOTES);
echo "<script type='text/javascript'>alert('$safeName')</script>";

2. Missing Input Validation & Sanitization #

You don't check if name or email are empty, nor do you validate the email format. This can lead to empty or invalid emails being sent, or form submissions failing silently.

Fix: Add validation before processing any input:

if(empty($_POST['name']) || empty($_POST['email'])) {
    die("Please fill in all required fields.");
}

if(!filter_var($_POST['email'], FILTER_VALIDATE_EMAIL)) {
    die("Please enter a valid email address.");
}

3. Incomplete Email Sending Logic #

Your code cuts off at $subject...—we can't see the actual email sending logic (like using PHP's mail() function). Common pitfalls here include:

• Missing essential email headers (like From, Reply-To, or Content-Type)
• Not handling failures from the mail() function
• Ignoring email deliverability best practices

Example Fix for Sending Emails:

$to = "your-inbox@mydomain.com";
$subject = "Contact Form Submission: $name";
$message = "Name: $name\nEmail: $email\nMessage: " . $_POST['message'];
$headers = "From: $email\r\n" .
           "Reply-To: $email\r\n" .
           "X-Mailer: PHP/" . phpversion();

if(mail($to, $subject, $message, $headers)) {
    echo "Thank you for your message—we'll get back to you soon!";
} else {
    echo "Oops, something went wrong. Please try again later.";
}

4. Mixed Request Methods #

You use $_REQUEST['submit'] to trigger the logic, but pull data from $_POST. Contact forms should use POST exclusively—$_REQUEST includes GET parameters too, which means someone could trigger form submissions via a simple URL, leading to spam or accidental submissions.

Fix: Check for POST requests explicitly:

if($_SERVER['REQUEST_METHOD'] === 'POST' && isset($_POST['submit'])) {
    // Your form processing logic here
}

5. Poor Error Handling #

You have a try block but no corresponding catch block. Additionally, if the mail() function fails, you won't get any feedback to debug the issue.

Fix: Add proper error handling and logging:

try {
    // Your form processing logic
    if(!mail($to, $subject, $message, $headers)) {
        throw new Exception("Failed to send email via PHP mail() function.");
    }
} catch(Exception $e) {
    error_log("Contact form error: " . $e->getMessage());
    echo "An error occurred. Please try again later.";
}

Environment-Specific Notes (EC2 + GoDaddy) #

• EC2 Email Setup: By default, EC2 instances don't have a mail server configured. You'll need to install and configure Postfix/Sendmail, or use a more reliable service like Amazon SES (recommended for better deliverability and avoiding spam filters).
• GoDaddy DNS Records: To prevent your emails from being marked as spam, add SPF and DKIM records to your GoDaddy domain settings. For Amazon SES, follow their documentation to generate and add these records.

内容的提问来源于stack exchange，提问作者mmw