<p>Reading the <a href="https://github.com/pixelandtonic/ContactForm/blob/master/README.md" rel="nofollow">documentation</a> it sounds like you should be able to specify <code>toEmail</code> using a text input. I'm guessing that it is using the default email because you aren't validating the email address first.</p>

<p><code>&lt;input type="text" name="toEmail"&gt;</code></p>

<p>The plugin will get <code>toEmail</code> from the post request and validate it for use.</p>

<pre><code>$toEmail = craft()-&gt;request-&gt;getPost('toEmail');
$toEmail = craft()-&gt;security-&gt;validateData($toEmail);
</code></pre>

CC BY-SA 3.0
2016-06-13T09:52:04.380Z
you'd think so but still defaulting/sending to the email address specified in the plugin settings :/
Cole Henley
CC BY-SA 3.0
2016-06-13T11:54:39.870Z
so should above be in my `contactform.php` config file or my plugin that is tapping into the `beforeSend` event?
Cole Henley
CC BY-SA 3.0
2016-06-13T12:14:38.490Z
Cole, looking at the docs for the plugin, you don't need to use the `onBeforeSend` event for this, just add the `toEmail` text field to your form and then add the code above to your `contactform.php` config file and it should work.
Steve Rowling
CC BY-SA 3.0
2016-06-13T12:31:12.880Z
@SteveRowling alas tried with several variations (including hashing the email in my config file before validating) but with no success
Cole Henley
CC BY-SA 3.0
2016-06-13T12:39:02.913Z
Any way of debugging whether Contact Form is picking up my custom config? Shoving a plugin log into the Service and it is only picking up from the core plugin settings
Cole Henley
CC BY-SA 3.0
2016-06-13T13:23:02.373Z
@ColeHenley I think I see what's going on now. The example in the docs adds a toEmail in a hidden field that is hashed to produce a secure value. This is then checked using the `craft()->security->validateData($toEmail)` function. If you are accepting an email from a text field, you won't be able to hash it using Craft's validation key, so the validation check will always fail. So you can use a text field to get a toEmail, but as you cant validate it, you will need to remove the validation line. This leaves the form open to being used as a spam relay though.
Steve Rowling
CC BY-SA 3.0
2016-06-13T14:02:09.587Z
Managed to get an email from a text input into the settings by using `name="message[toEmail]"` in the form and then `craft()->request->getPost('message.toEmail');` in the config but seems the validation fails...
Luke Pearce
CC BY-SA 3.0
2016-06-13T14:44:26.990Z
@LukePearce Are you hashing the value from the text input using Craft's security function? If not, it will never pass validation. If you take the validation line out, does it successfully pass the email address through to the plugin?
Steve Rowling
CC BY-SA 3.0
2016-06-13T14:50:23.040Z
Tried hashing and it returned null using `$toEmail = hash_hmac( "sha256", $toEmail );` What you could always do is modify line 45 of `ContactFormService.php` and set the `$toEmail` variable directly.
Luke Pearce
CC BY-SA 3.0
2016-06-13T09:47:59.447Z
2016-06-13T09:47:59.447Z
Luke Pearce
<p>I'm trying to leverage the <a href="https://github.com/pixelandtonic/ContactForm" rel="nofollow">Contact Form plugin</a> so I can dynamically specify the <strong>To</strong> email/recipient (via a text input, not as a hidden field). </p>

<p>I've tried via my own plugin to tap into the <code>beforeSend</code> event and also via config (eg <a href="https://gist.github.com/cole007/e65f028cc58140ed3b0f6910fc9615d6" rel="nofollow">https://gist.github.com/cole007/e65f028cc58140ed3b0f6910fc9615d6</a>). </p>

<p>However, the sent message always defaults to send to the recipient specified in the plugin settings. Any thoughts on how to resolve, or if this is indeed possible?</p>

<plugin-development><emails><plugin-contactform>
Dynamically specify the 'To' email/recipient using Contact Form plugin
# Dynamically specify the 'To' email/recipient using Contact Form plugin

(Asked by: username_0 on 2016-06-13)

I'm trying to leverage the [Contact Form plugin](https://github.com/pixelandtonic/ContactForm) so I can dynamically specify the **To** email/recipient (via a text input, not as a hidden field).

I've tried via my own plugin to tap into the `beforeSend` event and also via config (eg <https://gist.github.com/cole007/e65f028cc58140ed3b0f6910fc9615d6>).

However, the sent message always defaults to send to the recipient specified in the plugin settings. Any thoughts on how to resolve, or if this is indeed possible?

**Tags:** plugin-development, emails, plugin-contactform


---

## 1 answers

### Answer by username_1 on 2016-06-13. Score: 1

Reading the documentation it sounds like you should be able to specify toEmail using a text input. I'm guessing that it is using the default email because you aren't validating the email address first.

The plugin will get toEmail from the post request and validate it for use.
$toEmail = craft()->request->getPost('toEmail');
$toEmail = craft()->security->validateData($toEmail);

> **Comments:**
> **username_0**: you'd think so but still defaulting/sending to the email address specified in the plugin settings :/  
> **username_0**: so should above be in my `contactform.php` config file or my plugin that is tapping into the `beforeSend` event?  
> **username_2**: Cole, looking at the docs for the plugin, you don't need to use the `onBeforeSend` event for this, just add the `toEmail` text field to your form and then add the code above to your `contactform.php` config file and it should work.  
> **username_0**: @SteveRowling alas tried with several variations (including hashing the email in my config file before validating) but with no success  
> **username_0**: Any way of debugging whether Contact Form is picking up my custom config? Shoving a plugin log into the Service and it is only picking up from the core plugin settings  
> **username_2**: @ColeHenley I think I see what's going on now. The example in the docs adds a toEmail in a hidden field that is hashed to produce a secure value. This is then checked using the `craft()->security->validateData($toEmail)` function. If you are accepting an email from a text field, you won't be able to hash it using Craft's validation key, so the validation check will always fail. So you can use a text field to get a toEmail, but as you cant validate it, you will need to remove the validation line. This leaves the form open to being used as a spam relay though.  
> **username_1**: Managed to get an email from a text input into the settings by using `name="message[toEmail]"` in the form and then `craft()->request->getPost('message.toEmail');` in the config but seems the validation fails...  
> **username_2**: @LukePearce Are you hashing the value from the text input using Craft's security function? If not, it will never pass validation. If you take the validation line out, does it successfully pass the email address through to the plugin?  
> **username_1**: Tried hashing and it returned null using `$toEmail = hash_hmac( "sha256", $toEmail );` What you could always do is modify line 45 of `ContactFormService.php` and set the `$toEmail` variable directly.  

---

