PHP Mail hide other recipient addresses with multiple function calls

Question

I have a PHP script which sends an e-card to multiple recipients in function calls (takes an array of comma-separated email addresses and mail() s to each one individually). However, when looking at the received email, each client can see the other addresses that the email was sent to, making me believe they are all being sent in one email, despite the separate mail() calls. Here is my current code:

<?php
$headers  = "From: ".$_POST['email']."\r\n"; 
$headers .= "Content-type: text/html\r\n";
$array=explode(",", $_POST['sendto']);
for ($i = 0; $i < count($array); ++$i) {
    mail(trim($array[$i]), "Happy Holidays!", $body, $headers);
}
?>

How do I fix this so that the recipient can only see their email address in the "to" field? Thanks!

Answer 1

What you want to use is the BCC field.

• https://en.wikipedia.org/wiki/Blind_carbon_copy

Code:

<?php

$_POST['email'] = str_replace(array("\n", "\r"), '', $_POST['email']);
$_POST['sendto'] = str_replace(array("\n", "\r"), '', $_POST['sendto']);

$headers = "From: " . $_POST['email'] . "\r\n"
         . "Content-Type: text/html\r\n"
         . "BCC: " . $_POST['sendto'] . "\r\n";
mail($_POST['email'], 'Happy Holidays!', $body, $headers);

?>

Send the email to the sender, but BCC the recipients. Also I removed \\r and \\n chars from the BCC and FROM field otherwise will allow mail header injection attack. Make sure to do the same to $body.