Sending HTML Emails with Attachments in PHP

An HTML email with attachments combines a validated message body with MIME attachments.

What It Does

An HTML email with attachments combines a validated message body with MIME attachments. The following examples distinguish a normal use case, a boundary case and a practical application.

Requirements and Compatibility

A maintained SMTP mailer, a verified sender domain and approved SMTP credentials; email delivery is asynchronous.

The code focuses on the core concept. Production implementation may also need routes, validation, persistence, authorization or deployment tooling.

Example 1: Basic Behavior

Use a maintained SMTP library rather than implementing MIME and TLS yourself.

composer require symfony/mailer symfony/mime

This is a command-line example; use it in its appropriate file or shell, not in the PHP source editor.

Example 2: Another Case

Send an HTML/text multipart message with SMTP credentials and TLS configured in MAILER_DSN.

<?php
require __DIR__ . '/vendor/autoload.php';
use Symfony\Component\Mailer\Transport;
use Symfony\Component\Mailer\Mailer;
use Symfony\Component\Mime\Email;
$dsn = getenv('MAILER_DSN');
if (!$dsn) throw new RuntimeException('MAILER_DSN is required');
$email = (new Email())
    ->from('[email protected]')
    ->to('[email protected]')
    ->subject('Report is ready')
    ->text('Your report is ready.')
    ->html('<p>Your report is <strong>ready</strong>.</p>');
(new Mailer(Transport::fromDsn($dsn)))->send($email);

This example depends on an installed extension, third-party library or configured service and is not a standalone local test.

Practical Example: Putting It to Use

Use an allowlist for attachment names and independently check resolved path, permissions, file size and actual content type.

<?php
$root = '/srv/reports';
$requested = 'summary.pdf';
if (basename($requested) !== $requested || !preg_match('/^[a-z0-9_-]+\.pdf$/iD', $requested)) throw new InvalidArgumentException('Invalid attachment');
$path = $root . DIRECTORY_SEPARATOR . $requested;
// Verify the real path remains inside $root, check size and MIME before calling the mailer.
echo $path;

Important Behavior and Edge Cases

Read only approved files within a bounded size and avoid sending server-private paths or user-supplied filenames blindly.

Comparison with Related Functions or Approaches

Common Beginner Mistakes

Key Takeaways

• An HTML email with attachments combines a validated message body with MIME attachments.
• Read only approved files within a bounded size and avoid sending server-private paths or user-supplied filenames blindly.
• Attach files using a mailer that constructs correct MIME headers.

Before adapting these examples, verify the return values, test the failure paths and confirm that your application meets its security and environment requirements.