PHP Contact Form with Email

What we are building

A contact form lets visitors send you a message from your website. It has two pieces: an HTML form the user fills in, and a PHP file that validates the input and sends it to your email. Handling it safely and reliably is a very common task.

The contact form

<form method="post" action="contact.php">
  <input type="text"  name="name"    placeholder="Your name">
  <input type="email" name="email"   placeholder="Your email">
  <textarea name="message" placeholder="Message"></textarea>
  <button type="submit">Send</button>
</form>

The form posts to contact.php. Each field's name is the key PHP reads. Keep the fields simple and clearly labelled.

Validating input

Never email raw input. Check it first.

<?php
  $name    = trim($_POST["name"] ?? "");
  $email   = trim($_POST["email"] ?? "");
  $message = trim($_POST["message"] ?? "");

  $errors = [];
  if ($name === "") $errors[] = "Name required";
  if (!filter_var($email, FILTER_VALIDATE_EMAIL)) $errors[] = "Valid email required";
  if ($message === "") $errors[] = "Message required";
?>

We trim each field, require a name and message, and validate the email with filter_var. Only send the mail if $errors is empty.

Sending the email

<?php
  if (empty($errors)) {
      $to      = "you@yoursite.com";
      $subject = "New contact from $name";
      $body    = "From: $name ($email)\n\n$message";
      $headers = "From: no-reply@yoursite.com\r\n";
      $headers .= "Reply-To: $email\r\n";

      if (mail($to, $subject, $body, $headers)) {
          echo "Message sent";
      }
  }
?>

Notice From is your own address and the visitor's email goes in Reply-To — so you can reply, without triggering spoofing filters.

Why use PHPMailer

The plain mail() function often lands in spam or fails silently. For real sites, use PHPMailer, which sends through SMTP with your email account's login, so messages are properly authenticated and reach the inbox.

<?php
  // simplified PHPMailer idea:
  $mail->isSMTP();
  $mail->Host = "smtp.gmail.com";
  $mail->SMTPAuth = true;
  $mail->Username = "you@gmail.com";
  $mail->Password = "app-password";
  $mail->send();
?>

PHPMailer handles authentication, encoding and attachments correctly — the reliable choice for production.

Common mistakes

• Emailing raw input. Always validate; check email with filter_var.
• Putting the visitor email in From. Use your address in From, visitor's in Reply-To.
• Relying on mail() in production. Use PHPMailer + SMTP for reliable delivery.
• No spam protection. Add a honeypot or CAPTCHA to stop bots.

Summary

• A contact form = an HTML form plus a PHP handler that emails you.
• Validate every field and check the email with filter_var.
• Put your address in From, the visitor's in Reply-To.
• Use PHPMailer with SMTP for reliable delivery, not plain mail().
• Add spam protection like a honeypot or CAPTCHA.

Next, validate input thoroughly with form validation, or add a check with PHP CAPTCHA.