ellite/Wallos · error · Exception

Invalid address (to/cc/bcc)

Error message

Invalid address (to/cc/bcc): %s

What it means

addAnAddress throws 'Invalid address (to/cc/bcc): %s' when the recipient address fails static::validateAddress() (default: PCRE-based check, or an injected validator). The kind is echoed in the message. Like other address errors it only throws when $this->exceptions is true, otherwise it records the error and returns false.

Solutions

  1. Validate with PHPMailer::validateAddress($email) before adding and surface a friendly error to the user
  2. Split comma/semicolon-separated recipient strings with a parser (or use RFC 822 parsing) before addAddress
  3. Strip whitespace, newlines, and angle brackets before passing the address
  4. Check/replace a custom $validator override that may be too strict
  5. Ensure ext-intl/idn_to_ascii works if using unicode domains, or pre-convert to punycode

Example fix

// before
$mail->addAddress($_POST['recipients']); // 'a@x.com, b@y.com'
// after
foreach (array_filter(array_map('trim', explode(',', $_POST['recipients']))) as $rcpt) {
    if (!PHPMailer::validateAddress($rcpt)) {
        continue; // or collect and report
    }
    $mail->addAddress($rcpt);
}
Defensive patterns

Strategy: validation

Validate before calling

foreach ($recipients as $r) { if (!PHPMailer::validateAddress(trim($r))) { throw new InvalidArgumentException("Invalid recipient: $r"); } }

Type guard

function isValidEmail(mixed $v): bool { return is_string($v) && PHPMailer::validateAddress(trim($v)); }

Try / catch

try { $mail->send(); } catch (PHPMailer\PHPMailer\Exception $e) { if (str_contains($e->getMessage(), 'Invalid address')) { log_invalid_recipient($e->getMessage()); } throw $e; }

Prevention

When it happens

Trigger: $mail->addAddress($addr)/addCC/addBCC where $addr is empty, lacks a domain, contains illegal characters, or otherwise fails validateAddress(); also when queued recipients are replayed in preSend and fail validation.

Common situations: Form input not validated server-side, placeholder strings left in config ('user@example' with no TLD is actually valid to the regex but 'foo@' is not), comma-separated lists passed as a single address, or a custom validator injected via PHPMailer::$validator rejecting legitimate addresses.

Understand the failure class

Background: "invalid id" errors: invalid identifier format — why libraries reject IDs before lookup, and how to fix them — this error's family across 37 libraries.

Related errors


AI-assisted analysis of ellite/Wallos@52820e87ca (2026-09-13). Data as JSON: /api/errors/e345a4d650011a3c. Report an issue: GitHub.

Appendix: source

Thrown at libs/PHPMailer/PHPMailer.php:1181

            $this->setError($error_message);
            $this->edebug($error_message);
            if ($this->exceptions) {
                throw new Exception($error_message);
            }

            return false;
        }
        if (!static::validateAddress($address)) {
            $error_message = sprintf(
                '%s (%s): %s',
                $this->lang('invalid_address'),
                $kind,
                $address
            );
            $this->setError($error_message);
            $this->edebug($error_message);
            if ($this->exceptions) {
                throw new Exception($error_message);
            }

            return false;
        }
        if ('Reply-To' !== $kind) {
            if (!array_key_exists(strtolower($address), $this->all_recipients)) {
                $this->{$kind}[] = [$address, $name];
                $this->all_recipients[strtolower($address)] = true;

                return true;
            }
        } elseif (!array_key_exists(strtolower($address), $this->ReplyTo)) {
            $this->ReplyTo[strtolower($address)] = [$address, $name];

            return true;
        }

        return false;

View on GitHub (pinned to 52820e87ca)