Question

I want to run a web application on php and mysql, using the CakePHP framework. And to keep the threshold of using the site at a very low place, I want to not use the standard login with username/password. (And I don’t want to hassle my users with something like OpenID either. Goes to user type.)

So I’m thinking that the users shall be able to log in by sending an email to [e-mail] with no subject or content required. And they will get, in reply, an email with a link that will log them in (it will contain a hash). Also I will let the users do some actions without even visiting the site at all, just send an email with [e-mail] and the command will be carried out. I will assume that the users and their email providers takes care of their email account security and as such there is no need for it on my site.

Now, how do I go from an email is sent to an account that is not read by humans to there being fired off some script (basically a ‘dummy browser client’ calls an url( and the cakephp will take care of the rest)?

---

I have never used a cron job before, but I do think I understand their purpose or how they generally work. I can not have the script be called by random people visiting the site, as that solution won’t work for several reasons. I think I would like to hear more about the possibility of having the script be run as response to an email coming in, if anyone has any input at all on that. If it’s run as a cron job it would only check every X minutes and users would get a lag in their response (if i understand it correctly).

Since there will be different email addresses for different commands, like [e-mail] and I know what to do and how to do it to based on the sender email, i dont even need the content, subject or any other headers from the email.

---

There is a lot of worry about security of this application, I understand the issues, but without giving away my concept, I dont think it is a big issue for what I am doing. Also about the usability issue, there really isnt any. It’s just gonna be login to provide changes on a users profile if/when they need that and one other command. And this is the main email and is very easy to remember and the outset of this whole concept.

Answer 1

I have used the pop3 php class with great success (there is also a Pear POP3 module).

Using the pop3 class looks something like this:

require ('pop3.php');  $pop3 = new pop3_class(); $pop3->hostname = MAILHOST; $pop3->Open(); $pop3->Login('[e-mail]', 'mypassword');  foreach($pop3->ListMessages('','') as $msgidx => $msgsize) {     $headers = '';     $body = '';      $pop3->RetrieveMessage($msgidx, $headers, $body, -1); } 

I use it to monitor a POP3 mailbox which feeds into a database.

It gets called by a cronjob which uses wget to call the url to my php script.

*/5 * * * * 'wget -q --http-user=me --http-passwd=pass 'http://mydomain.com/mail.php'' >> /dev/null 2>&1 

Edit

I’ve been thinking about your need to have users send certain site commands by email.

Wouldn’t it be easier to have a single address that multiple commands can be sent to rather than having multiple addresses?

I think the security concerns are pretty valid too. Unless the commands are non-destructive or aren’t doing anything user-specific, the system will be wide open to anyone who knows how to spoof an email address (which would be everyone 🙂 ).