1

I'm using PHPMailer 5 to send plain text emails from forms. It looks like some users are pasting content from word into the textarea fields and the resulting email comes out with lots of non-readable characters (e.g. “).

I've tried adding $mail->CharSet = 'UTF-8'; and that seems to fix the tests I've done (e.g. bullet lists are now coming through properly).

$mail = new PHPMailer;
$mail->CharSet = 'UTF-8';
$mail->ContentType = 'text/plain'; 
$mail->IsHTML(false);

Are there any security issues or other issues that could come up from setting the character set to UTF-8?

user1480951
  • 143
  • 2
  • 13

1 Answers1

0

You're doing it right. PHPMailer defaults (as does PHP's internal mail function) to the ISO-8859-1 character set because that can be used in the absence of the mbstring PHP extension which is not available by default - and if you don't have that extension, UTF-8 support won't work. Once you switch to using UTF-8, your entire toolchain must also use UTF-8 - your editors, your database, your database connection. You also need to be wary of functions like strlen and substr, which are not UTF-8-safe because they work in bytes, not chars (which may be more than 1 byte long). Whenever one of those things gets it wrong, you'll see the kind of corruption you have. It's a good exercise to stick in some difficult strings to test with (though see my answer about that) to make sure it comes through unscathed.

Unfortunately, MS Word is one of the best examples of how to do UTF-8 badly; it often riddles the text with unnecessary unusual characters, extra control chars etc, so I would advise doing some heavy filtering on your inputs - editors like CKEditor have built-in filters to help deal with Word's issues. That doesn't have anything to do with PHPMailer, it's a just a common problem with dealing with input that has been touched by Word.

The only thing you're doing wrong is using PHPMailer 5.x; current version is 6.x.

Synchro
  • 35,538
  • 15
  • 81
  • 104
  • Thanks. We plan to upgrade to v6 but need to upgrade PHP first. I'm not using a database, just sending to an email so that won't be a problem. We have a plain textarea box, no wysiwyg, but it looks like people are copying lists into it from Word. Thanks for the details on potential issues. I don't know a whole lot about character set differences. – user1480951 Jan 29 '19 at 14:01