Create an email system that hides the email addresses of users.

Question

Charleslp2007 0 Newbie Poster

18 Years Ago

Hello !!!

I am the owner of a website which is a social network. The members can email each other but there is a little problem: They can see the email address of the person who wrote them. As you can see, this is uncomfortable for some people because there is no privacy.

I need help. I want to build an email system in which the members of my website can email each other but their email addresses remain secret as in Hotornot or Hi5.
There, when you get a message, you can read the message but the email address of the person who wrote you remains secret.

Please, could you tell me how to do it? I will be very grateful !!!!

email php

3 Contributors
8 Replies
306 Views
1 Month Discussion Span
Latest Post 18 Years Ago Latest Post by digital-ether

Dani AI

Generated 9 Months Ago

A short, practical plan that fills gaps in the thread and avoids leaking addresses.

Summary and recommendation: implement an internal private‑message (PM) store + email notifications (no real addresses in messages) as the simplest, safest solution; only use real email aliasing/forwarding if you must support reply‑by‑email. The mail() examples in this thread show the idea but are fragile and can be abused (email/header injection); use a proper mail library (SMTP/DKIM support) for notifications instead of raw mail(). (shiflett.org)

PM implementation (what to change in mail.php/view.php): store messages in your DB and send a notification that contains a secure link to the message. Example table (illustrative):

CREATE TABLE private_messages (
  id INT AUTO_INCREMENT PRIMARY KEY,
  conversation_id VARCHAR(64) NOT NULL,
  sender_id INT NOT NULL,
  recipient_id INT NOT NULL,
  reply_alias VARCHAR(128) DEFAULT NULL,
  subject VARCHAR(255),
  body TEXT NOT NULL,
  is_read TINYINT(1) DEFAULT 0,
  created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP
);

Flow: web form → validate & sanitize → INSERT into DB → send server email FROM no-reply@domain with a secure view/reply link (token tied to session/expiration). Replies are posted through the web UI so emails are never exposed. This builds on ’s PM idea but adds tokens, conversation IDs and server‑side notification best practices.

If you need reply‑by‑email (aliasing): generate per‑conversation addresses like msg-<token>@yourdomain, map them to conversation_id in DB, and route inbound mail to your app (either a local MTA virtual alias / pipe or a mail provider’s inbound webhook) so the server parses and attaches replies to the right conversation. Use Postfix virtual/pipe or a provider like Mailgun for inbound routing; polling via PHP’s IMAP functions is an alternative. (postfix.org)

Security & deliverability notes: forbid CR/LF in header fields, rate‑limit sends, verify user emails before forwarding, and sign/mail from your domain with SPF/DKIM to avoid deliverability problems. Use libraries (PHPMailer or modern mailer) and follow RFC/SPF/DKIM guidance. (shiflett.org)

References above clarify the technical pieces and show safer alternatives to the simple mail() approach suggested by ; ’s alias idea is the right direction if you need true email forwarding.

All 8 Replies

nav33n 472 Purple hazed!

18 Years Ago

<?php
// Have a button/link ("Send message") on the member profile. When clicked, it has to fetch the "email_address" of that member from the respective table. Assign it to $to_address. 
$to_address="address_of_the_recipient";
if(isset($_REQUEST['submit'])){
	$subject=$_REQUEST['subject'];
	$message=$_REQUEST['message'];
	$headers = 'From: Naveen < >' . "\r\n";
	mail($to_address, $subject, $message, $headers); 
	echo "Message sent successfully..";
} else {
?>
<html>
<body>
<FORM METHOD=POST ACTION="mail.php">
Subject: <INPUT TYPE="text" NAME="subject" size="30"><br />
Message: <TEXTAREA NAME="message" ROWS="10" COLS="20"></TEXTAREA><br />
<INPUT TYPE="submit" name="submit" value="submit">
</FORM>
</body>
</html>
<?php 
}
?>

The above code has not been checked for sanity, but it does what it has to.
Cheers,
Nav

digital-ether 399 Nearly a Posting Virtuoso

18 Years Ago

I'm not familiar with the way Hotornot or Hi5 do it. Do you receive actual emails in your mailbox, or is it just notifications of Private messages from other users?

The easy way, is to have a private messaging system, and then notify users via email of new messages, and have them click on a a link to view the message and reply. So no emails are exchanged. The only email address is the one used to send out the message from your server (you could use or something similiar).

The other way would be to create an email address for each user on your site. You could have this be: . Then each message sent to gets redirected to the users actual emails address. This way, the users can email each other on their username generated by your website.

You can also generate a "conversation" email for two users. This is a random email that identifies a conversation (session) between two users.

Say, user1 wants to email user2.
They fill int he form on your site, and your site will forward the email to user2.
It will set the sender as
user2 replies to
your server receives an email from user2 addressed to
Your server forwards this to user1 setting the sender as

The trick is that you've assigned an email that is on your domain, so all emails between the two have to pass through your email server. So there you make the changes.

There are other methods.

Every method requires you to be able to receive incoming emails, and create email accounts on your server.

With PHP you can receive emails by connecting to your mailserver via POP3 or IMAP and download all new mails in your mailbox.
You can also create a mail pipe to your PHP script. This is done by editing your mail forwards and placing a PHP script as the forwarding address. Some of this can get very technical and dependent on the mailserver (MTA) used. Using POP3 or IMAP is simpler, but a pipe has the benefit that incoming mail is processed in real time.

Once you receive emails, you'll need a MIME parser that will parse out the senders and receivers address and make the necessary changes. There is a good mime parser at PEAR.

Reply to this topic

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.

Charleslp2007 0 Newbie Poster · Answer 1 · 2007-12-02T02:47:41+00:00

Hello nav33n,
Thanks for your time and knowledge. Please, forgive my ignorance, I am new in this. I am a little confused but I begin to understand more. By the way, here I have the file where I have the forms so people can email each other: mail.php

And this is the content:

<?php
include_once 'include/config.inc.php';
include_once 'include/options.inc.php';
include_once 'include/security.inc.php';
include_once 'include/functions.inc.php';
include_once 'templates/'.C_TEMP.'/config.php';
security(C_MAIL,$w[152]);
include_once 'templates/'.C_TEMP.'/header.php';
if(!C_MAILSH) printm($w[187],2);

if (isset($id)&&is_numeric($id)) {
if(!isset($a)) $a='';
if ($a == "s") {
if(empty($subject)||empty($message)||empty($remail)) printm('All field must be filled');
if (c_email($remail) == 0) printm($w[11]);
$subject=cb($subject);$message=cbmail($message);
$tmp=mysql_query("SELECT email FROM ".C_MYSQL_MEMBERS." WHERE id='".$id."' AND status >= '7'");
$row=mysql_fetch_array($tmp);
$toemail=$row;
unset($deactive);unset($m); // Special for hackers:)
if(isset($_SESSION) && is_numeric($_SESSION)) {

$tmp=mysql_query("SELECT email FROM ".C_MYSQL_MEMBERS." WHERE id='".$_SESSION."' AND status >= '7'");
$row=mysql_fetch_array($tmp);
$deactive = C_ANOTHER_MAIL ? $remail : $row;
}
else {
$deactive=$remail;
}
sendmail($deactive,$toemail,$subject,$message,'text');
printm($w[165],2);
} else {
?>
<script language="JavaScript">
<!--
function formCheck(form) {
if (form.subject.value == "")
{alert("<?=$w[166]?>");return false;}
if (form.message.value == "")
{alert("<?=$w[167]?>");return false;}

if (document.form.submit.action != "") {
document.form.submit.disabled=1;}
}
// -->
</script>

<form action="../mail.php" method="post" name=form OnSubmit="return formCheck(this)">
<input class=input type=hidden name="l" value="<?=$l?>">
<input class=input type=hidden name="id" value="<?=$id?>">
<input class=input type=hidden name="a" value="s">
<center><span class=head><?=$w[188]?>[<?=$id?>]</span>
<br>
<Table CellSpacing="<?=C_BORDER?>" CellPadding="0" width="<?=C_SWIDTH?>" bgcolor="<?=C_TBCOLOR?>"><Tr><Td>
<Table Border=0 CellSpacing="<?=C_IBORDER?>" CellPadding="<?=C_CELLP?>" width="<?=C_SWIDTH?>" class=mes>
<Tr align="<?=C_ALIGN?>" bgcolor="<?=COLOR1?>"><Td>
<?=$w[168]?></td><td><input class=input type=text name=subject maxlength="40"></td></tr>
<Tr align="<?=C_ALIGN?>" bgcolor="<?=COLOR1?>"><Td>
<?=$w[169]?></td>
<td><textarea class=textarea name=message cols=40 rows=15></textarea></td>
</tr>
<?
unset($deactive);unset($m); // Special for hackers:)
if(isset($_SESSION) && is_numeric($_SESSION)) { // If user registered and login
$tmp=mysql_query("SELECT email FROM ".C_MYSQL_MEMBERS." WHERE id='".$_SESSION."' AND status >= '7'");
$row=mysql_fetch_array($tmp);
$deactive = C_ANOTHER_MAIL ? 'value="'.$row.'"' : 'value="'.$row.'" readonly="true"';
}
else $deactive='';
?>
<Tr align="<?=C_ALIGN?>" bgcolor="<?=COLOR1?>"><Td>
<?=$w[60]?>
</td>
<td><input class=input type=text name=remail <?=$deactive?>></td></tr>
<Tr align="<?=C_ALIGN?>" bgcolor="<?=COLOR1?>"><Td colspan="2">
<input class=input type=submit value="<?=$w[170]?>" name="submit">
</td></tr></table></td></tr></table>
</form>
<?}} include_once 'templates/'.C_TEMP.'/footer.php';?>

You gave me a script. Please, in what part or parts of the file mail.php that I have should I insert the information that you gave me? By the way, I also have a file whose name is: view.php

In that file is the link that takes me to the file mail.php

Here are the last parts of the file view.php :

Should I make changes in view.php ??

Just answer me if possible. Thanks for your time and knowledge.

Charleslp2007 0 Newbie Poster · Answer 2 · 2007-12-02T08:24:30+00:00

Interesting. How can a private messaging system be built? Do you have the software script please? I will be very grateful if you tell me about it.

digital-ether 399 Nearly a Posting Virtuoso Team Colleague · Answer 3 · 2007-12-02T11:21:18+00:00

Interesting. How can a private messaging system be built? Do you have the software script please? I will be very grateful if you tell me about it.

A PM system is very simple. The simplest being:
1 db table. Say its called private_messages.
You then create a form that allows users to send private messages to other users.
On the form you need the user to input the username, and message they want to send.
So in your db table you'll have:

id, from, to, message, as the columns.

Id will be the primary key (unique index).

So when the user submits the form, you will save the from, to and msg fields in the database.

You then create 2 views for private messages. I being the list view, which views private messages for a user. And the message view, which views the individual messages.

eg:

$username = mysql_real_escape_string($_SESSION['username']); // from session
$query = "SELECT * from private_messages where to = '$username'";

where $_SESSION is the username of the logged in user.

Thats for list view.

Then view message view, you should get a message id from the URL, when the user licked on a single message in the list view.

$id = intval($_GET['id']); // from URL
$username = mysql_real_escape_string($_SESSION['username']); // from session
$query = "select * from private_messages where id=$id and to = '$username' LIMIT 1";

and of course theres the compose message view. Which is the form mentioned ...

There are many Private Messaging systems implemented in different web based apps, like this forum for instance. Just view how the interface is created and how the views are laid out to get an idea.
You can also download PM systems for some open source software, and look at the code.

Charleslp2007 0 Newbie Poster · Answer 4 · 2007-12-02T23:01:16+00:00

Thank you, I have already begune of your help I have advanced 70%. I will tell you when I have reached 100% of success !!!

Charleslp2007 0 Newbie Poster · Answer 5 · 2008-01-05T06:33:18+00:00

Hello !!! Please, just one little question and forgive me for disturbing you. I almost get the solution...almost. Where could I buy or download for free a script that has a social network with private messaging system? Thank you !!

digital-ether 399 Nearly a Posting Virtuoso Team Colleague · Answer 6 · 2008-01-05T08:21:05+00:00

There are quite a few social networking scripts out there. But I would recommend going with a Content Management System. (Unless you want something very specific).

I use Joomla, (joomla.org), then install the extensions that make it function like a social networking site. Like: Community Builder, Private Messaging Extensions, Friends extensions etc. You can get these from http://extensions.joomla.org/

Their forum will also help you out if you go with Joomla.

Create an email system that hides the email addresses of users.

Dani AI

Recommended Answers Collapse Answers

All 8 Replies

Recommended Answers