Question

I know it is possible to send html enabled emails. Is it also possible to send PHP enabled emails?

For this to count:

• php code has to be sent as plain text
• php code has to be executed on some server X only after recipient opens the email
• Server X is not the recipient’s machine

If this is possible, what are the consequential security issues that this brings up?

Answer 1

You are basically trying to force the remote email client to display a remote HTML page (generated by PHP). No clients will do that, because it’s a big security risk.

You could use AJAX, but all modern email clients will completely block any Javascript in the emails by default.

You can however request remote images. You could generate them on the fly (handle the jpg extension by PHP and generate the image on the fly), but that’s very likely to kill your emails as spam by any spam filter. Most email clients will block remote images by default, but will usually show a button to unblock them (this does not happen for javascript scripts).