The most common custom script on any site.
WHAT A FORM HANDLER MUST DO
Validate input Protect against automated submission Send the message reliably Not become a spam relay
THE CRITICAL RULE ON SENDING
Send from an address on your own domain, always. A form that sends from the visitor's address fails authentication and the message lands in spam or bounces.
Put the visitor's address in Reply-To so replying still reaches them.
SENDING PROPERLY
Use SMTP with a mailbox on your domain rather than the default mail function. This is the difference between messages arriving and messages disappearing.
SPAM PROTECTION
A captcha, a honeypot field, or a time check. Without any, your form will be submitting spam within days, and your account may hit sending limits.
WHAT NOT TO DO
Accept arbitrary recipient addresses from the form. That makes you an open relay, and it will be found and abused. Send the raw submission without validation.
TESTING
Submit the form and confirm the email arrives, at Gmail as well as your own domain.
Check it again periodically. Forms break silently.
