Sending HTML Email Safely

HTML email uses a MIME HTML body, safely escaped dynamic text and a plain-text alternative.

What It Does

HTML email uses a MIME HTML body, safely escaped dynamic text and a plain-text alternative. The following examples distinguish a normal use case, a boundary case and a practical application.

Requirements and Compatibility

A maintained SMTP mailer, a verified sender domain and approved SMTP credentials; email delivery is asynchronous.

The code focuses on the core concept. Production implementation may also need routes, validation, persistence, authorization or deployment tooling.

Example 1: Basic Behavior

Use a maintained SMTP library rather than implementing MIME and TLS yourself.

composer require symfony/mailer symfony/mime

This is a command-line example; use it in its appropriate file or shell, not in the PHP source editor.

Example 2: Another Case

Send an HTML/text multipart message with SMTP credentials and TLS configured in MAILER_DSN.

<?php
require __DIR__ . '/vendor/autoload.php';
use Symfony\Component\Mailer\Transport;
use Symfony\Component\Mailer\Mailer;
use Symfony\Component\Mime\Email;
$dsn = getenv('MAILER_DSN');
if (!$dsn) throw new RuntimeException('MAILER_DSN is required');
$email = (new Email())
    ->from('[email protected]')
    ->to('[email protected]')
    ->subject('Report is ready')
    ->text('Your report is ready.')
    ->html('<p>Your report is <strong>ready</strong>.</p>');
(new Mailer(Transport::fromDsn($dsn)))->send($email);

This example depends on an installed extension, third-party library or configured service and is not a standalone local test.

Practical Example: Putting It to Use

Escape interpolated recipient data before composing an HTML body.

<?php
$name = '<img src=x onerror=alert(1)>';
$body = '<p>Welcome ' . htmlspecialchars($name, ENT_QUOTES | ENT_SUBSTITUTE, 'UTF-8') . '</p>';
echo $body;

Important Behavior and Edge Cases

Untrusted text in email markup can inject unwanted links or layout; email clients support only limited HTML and CSS.

Comparison with Related Functions or Approaches

Common Beginner Mistakes

Key Takeaways

• HTML email uses a MIME HTML body, safely escaped dynamic text and a plain-text alternative.
• Untrusted text in email markup can inject unwanted links or layout; email clients support only limited HTML and CSS.
• Use a mailer to create multipart/alternative messages.

Before adapting these examples, verify the return values, test the failure paths and confirm that your application meets its security and environment requirements.