1

How do I correctly write out a path to a sendmail.php that is in the parent directly after it's uploaded to the hosting server?

Is it https://www.example.com or https://www.example.com/sendmail.php

Or, is it a good idea to have the sendmail.php in its own directory such as https://www.example.com/script/sendmail.php

In addition, must the webmaster allow server rights to see this PHP in order to have it work? How does the webmaster know if those right are allocated....

Improve this question
4
  • A word of caution: you shouldn't use scripts on your web server that can send email to anybody. Make sure that you edit the script or configure it so that it can only send email to a whitelist of known addresses. Otherwise it will be used as a email spam relay shortly. – Stephen Ostermiller♦ Aug 21 '17 at 16:48
  • 1
    In addition, the sendmail script has had issues for years that allowed hackers access to send emails. It may be fine now, however, I suggest researching options carefully. I would recommending starting here: ostermiller.org/contactform He is too modest to link to his stuff! – closetnoc Aug 21 '17 at 17:51
  • 1
    Additionally, should you choose to ignore the advice from closetnoc and Stephen, rename the file from sendmail.php to anything else. – Steve Aug 21 '17 at 22:22
  • @Steve Too many people fail to realize that simply disguising a script, while it does not solve all problems, does indeed make it less likely for a script to be compromised. Kudos for mentioning renaming the script! A trivial search is often used to find potentially vulnerable scripts. Vulnerable or not, just the reputation of the/a script means the likely hood of receiving overwhelming hack attempts at the very least. – closetnoc Aug 22 '17 at 4:58
3

It depends on what you're wanting to do, and it depends on your web server. However, in general, if you wanted to access a file named sendmail.php directly, you would simply place it into your document root directory, and then you could visit it at http://www.example.com/sendmail.php. This assumes that sendmail.php contains some code which you want the public to be able to execute. The directory name or whether it's in its own directory would really just be a matter of preference. However, if you were intended for that to contain scripts which would simply be included, then it would be best to place it in a directory outside of the document root and then include it inside of your script where you need it.

Yes, the server must have read access at least to the script, and execute access to the containing directories. If it can't read it, it can't execute it, and it would give you an error, usually a file permission error or perhaps the web server would serve a 403 status, etc. Most websites run PHP scripts, and so it should be assumed that a stock web hosting environment should be able to run those scripts out of the box. If there is an error, you may want to talk to your host.

That being said, sending mail can be a dangerous thing. Much of the spam out there doesn't come from email addresses that are intended for spam, but instead come from compromised websites where the spammer finds an unprotected for to send their emails. Most hosts will hold you responsible for any inappropriate email that you send. Therefore, it would be important to make sure that your scripts are well protected, and be especially certain to sanitize the data that you plan to send through your script.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.