I have a website with a client-side HTML contact form created manually (not as output of an HTML constructor like PHP):

<form action="mailto:someone@example.com">
    Email Adress:<br>
    <input type="email" name="email_address" value="" maxlength="100" />
    <input type="submit" value="Submit" />

I desire to hide that mailto:someone@example.com from all HTML source codes that include it, so that users would not be able to find the email address even in source code directly;
This way, generally only customers who have sent me an email and got a reply --- would know the email address (unless the user undid the hiding operation).

Can shell-scripting help hide a destination email address of a client side form, somehow?

  • 1
    Why does your form include its destination email address? – Stephen Kitt Sep 19 '19 at 7:49
  • 1
    How does it work if you don’t have any backend handling? How do you prevent spammers abusing it? – Stephen Kitt Sep 19 '19 at 8:07
  • 1
    Shell scripting, no. You can "scramble" the email address so that it doesn't show as such in the HTML/CSS code, and is unscrambled on the fly by JavaScript when the page is loaded (I don't think "trawlers" play the Javascript they encounter, that would be too long and dangerous). – xenoid Sep 19 '19 at 8:11
  • 1
    a mailto: URL causes the web browser to launch an appropriate Mail User Agent or MUA (e.g. thunderbird. or kmail. or mutt in a terminal. or outlook on windows. or whatever the user has set as their default mail client) when the mailto: link is clicked. The browser passes the mailto: address to the MUA. If you don't want the email address in the HTML source at all then the ONLY way to do that is to have a CGI or PHP or whatever script on the web-server backend process the form data and send an email. – cas Sep 19 '19 at 10:08
  • 2
    I know this is precisely what you don't want to do, but it's worth stating explicitly: DO NOT allow such a backend script to accept the recipient address from the form data. Or from the user in any other way. Doing that will allow spammers to abuse your mail form and send their spam to any address. This will get your web server (and/or your mail server if the web server relays the outbound mail through a mail server) blacklisted as a spam source. – cas Sep 19 '19 at 10:10

No. shell scripting will not help here. and it is not in any way applicable to mailto forms.

The form is processed by their user agent and the user-agent must at time of submission know the email address to submit the response to.

About the best you can do is use an "onsubmit" trigger in javascript to poulate the action property of the form. that will make it harder to find the email address by inspecting the web page.

However, upon submission the user will then be able to see the email address that the form is going to because their web user agent will open an email user agent and the email user agent will expose the address.

One way that shell scripting could possibly be used would be if you created a sever side CGI script that processed the form submission and created an email from the server to your secret address. you would then point the action of the form to the HTTP address of the CGI script.

Not the answer you're looking for? Browse other questions tagged or ask your own question.