GMail SMTP avoid using direct password in PHP code

Question

I am going to use PHP for sending emails. My PHP is supposed to be on a shared host. I have found codes to send email via PHP but I'm worried about writing direct password into the PHP code. Does PHP or GMail SMTP server provide any way to avoid using direct password? maybe something similar to API authentication?

Answer 1

I never have actually tried to just send emails true a SMTP server such google, since all this services need authentication. There is some great projects in Github such this, this allow to send emails via SMTP using secure ports, authentication, SSL, etc.. (remember that php files are server side, so users cant access to this information. so your pass it is secure.)

and if you visit their repo you will find their sample:

<?php
require 'class.phpmailer.php';

$mail = new PHPMailer;

$mail->IsSMTP();                                      // Set mailer to use SMTP
$mail->Host = 'smtp1.example.com;smtp2.example.com';  // Specify main and backup server
$mail->SMTPAuth = true;                               // Enable SMTP authentication
$mail->Username = 'jswan';                            // SMTP username
$mail->Password = 'secret';                           // SMTP password
$mail->SMTPSecure = 'tls';                            // Enable encryption, 'ssl' also accepted

$mail->From = '[email protected]';
$mail->FromName = 'Mailer';
$mail->AddAddress('[email protected]', 'Josh Adams');  // Add a recipient
$mail->AddAddress('[email protected]');               // Name is optional
$mail->AddReplyTo('[email protected]', 'Information');
$mail->AddCC('[email protected]');
$mail->AddBCC('[email protected]');

$mail->WordWrap = 50;                                 // Set word wrap to 50 characters
$mail->AddAttachment('/var/tmp/file.tar.gz');         // Add attachments
$mail->AddAttachment('/tmp/image.jpg', 'new.jpg');    // Optional name
$mail->IsHTML(true);                                  // Set email format to HTML

$mail->Subject = 'Here is the subject';
$mail->Body    = 'This is the HTML message body <b>in bold!</b>';
$mail->AltBody = 'This is the body in plain text for non-HTML mail clients';

if(!$mail->Send()) {
   echo 'Message could not be sent.';
   echo 'Mailer Error: ' . $mail->ErrorInfo;
   exit;
}

echo 'Message has been sent';

But if you dont want to go and hard code the passwords on the php controller or what ever you gotta use to process the emails, you can always use the mail() function on php to send emails.

easy sample find on the documentation:

<?php
$to      = '[email protected]';
$subject = 'the subject';
$message = 'hello';
$headers = 'From: [email protected]' . "\r\n" .
    'Reply-To: [email protected]' . "\r\n" .
    'X-Mailer: PHP/' . phpversion();

mail($to, $subject, $message, $headers);
?>

This function is a SMTP way to send emails, but the authentication it is always required but in this case it is made with the server, so all headers has to be set to be able send a proper email.

Note some server providers don't aloud sending emails true this function, so in the end you will need to create or use a php SMTP email class to process the emails, and this file have to have the password for authentication reason.