Problem implementing a two-factor authentication protocol using PHP, HTML, backed up to an SQL database

current code sends a message to the screen successfully, however, the text message never gets to the cell phone it was intended. Lets answer Why?

<?php

	$to = "cellnumber@vtext.com";   // my cell #
	$from = "emailaddress@gmail.com";
	$message = "New Text Message ...";
	$headers = "From: $from\n";
  if (mail($to, '', $message, $headers))
  {
  	echo "Text was sent successfully!";
  }	else {
  	echo "Text FAILED to be sent!";
  }

?>

If you change it to send a message to an email address instead, does it work? Do you have your SMTP set up correctly to send emails out? If you’re using gmail as your mail sender, I think you’ll need to enable TLS and send via the appropriate port, and it might be easier to use PHPMailer instead of the built-in mail() function for that.

i just changed to send to an email address. If failed.

As above. First you need to configure your development environment so it can send emails.

nope, I’m looking at PHPMailer package right now. I think I should install it and work it that route.

The project I’m developing is PHP, HTML, backed into a MySql database. Its all on my Apache WebServer local host right now. Do you think PHPMailer package is what I need to actually be able to implement 2-factor authentication to a cell phone? I don’t need email capabilities at the moment.

Your original code in the first post is sending an email, so it seems that you do need email capabilities. When you send an email in the way your code does, it may well end up on a mobile phone but it’s doing it because you are using an email to SMS gateway.

I expect PHPMailer will still need to know what mail server to use to actually send the email. You can’t really send an email without going via an SMTP server, unless I’m awfully out of date.

what I need is to set up 2 factor authentication. I was just starting out using email as a try. I don’t know anything about the set up to this point. I’m just learning.

I’m reading all about PHPMailer package setup right now. It looks very complicated as well.

To do any kind of two-factor authentication, I think you’ll need to master sending emails. Once you’ve got that working, you can then find an email to SMS gateway, and all you’ll need to do is follow their instructions on how to actually implement their gateway - sometimes it’s as easy as putting the number in the subject line and the message in the message, sometimes it’s more complex.

I don’t know of another way to send SMS messages, though I’m sure there probably is one it’s probably more difficult than an email gateway. For example I once had a catalogue which had a few hardware boxes that would do it - insert a SIM card, connect it to a serial port on your server, and off you go - but if you’re intending to host this on someone else’s server that’s not going to work as they probably won’t allow the box to be plugged in.

PHPMailer can look complicated if you’re new to PHP, but it’s really not and there are thousands of examples out there showing how to use it, and how to use it to send via Gmail for example. If you want to send via a different email provider, you can probably find examples for them too.

That’s probably why your PHP mail() is failing. You would need to set up a mail server for that to work. However, using PHPMailer will save you that hassle.

I would suggest you abandon the SMS implementation and either send the code to an email address or setup TOTP using an app like Google Authenticator. It’s simpler and cheaper.

Kicken, thanks for your input. What do you mean when you say cheaper?

I’m definitely new to this type of implementation using PHP on my Apache WebServer. I’ve already learned alot, but I do know security is a priority if I want to continue hosting this project on my own server. I’ve considered porting all of my work onto an outside hosting service, however, I’m not ready to consider that option just yet as I would really like to try and do it on my own Apache WebServer so I have complete control of the bandwidth coming into it.

Another person suggested using Google Authenticator as it would be cheaper. Is that person referring to monitary cost, or computer resource cost?

Using an email to send a text is not reliable or universally possible. @vtext.com for example will only work for customers of Verizon. Other providers may or may not have a similar service, but you’d need to ask you users who their provider is to know which one to use.

If you only need to send a text to yourself and you know it works for your number, then fine. If you need to be able to send a text to any number, then you need to use a SMS service such as Twilio which is going to have a monetary cost per month.

Edit: Two-factor auth using SMS is generally considered to be the worst form of 2fa also and should be avoided. It’s popular because it’s often the easiest way for non-tech-savy users to deal with, but the apps are generally better.

As far as I know, only way to send SMS is through a gateway such as Twillio. They offer pretty cheap numbers you can rent out. They do have free trial versions with a default loaded amount of $15.00 to use and develop with. After that, you gotta upgrade to their paid services. Just thought I’d mention that in case you still want to go that route. They got a Composer package you can install so should be pretty simple to implement.

Oh really? That’s no use then, in my opinion. A proper gateway such as the one that @spaceshiptrooper suggests would be the only way.

I would expect they mean monetary cost. Sending SMS messages isn’t usually free, unless you can find some convoluted way to make it use your own phone contract allowance.

I’m interested in developing my own protocol if necessary. I don’t want to incur any monetary costs of any kind. This project is simply a learning tool to keep my skills sharp. Hopefully, we can all put our heads together and find a solution using PHP code. It looks as though PHPMailer is already established however, so, I’m going to dig into it further.

Is there a way to install it really fast and easy? So far, I’m at this location https://packagist.org/about at it is looking pretty scary to me right now. Not easy.

What, to send an SMS message? Well, I guess you could write something for your mobile phone to send the SMS messages for you. It won’t scale very well, but if that’s not an issue it might be an interesting project for you to develop.

I’m referring to a low level PHP implementation that would be similar to the class structure PHPMailer. It appears if we have PHPMailer already, it maybe faster to learn how to use it instead.

Implementation of what is the question I think.

Send Email? It’s complicated, that’s why things like PHPMailer or Symfony Mailer exist. They are easy to use and handle all the complexities of sending an email for you.

Send an SMS? You can’t just delivery an SMS yourself, it requires access to the cellular networks which is why you need to use a service. The best you could do for a DIY solution would be to try and turn your cell phone into a relay probably with an app of some sort.

Packagist pairs with composer. If you’re already using composer, you can install php mailer by simply running

composer require phpmailer/phpmailer

If you’re not using composer, I would suggest you start. However, you could also just download a release from their github page and set it up manually. The readme provides some information.

2 Likes