ellite/Wallos · error · Exception
Invalid address (to/cc/bcc)
Error message
Invalid address (to/cc/bcc): %s
What it means
addAnAddress throws 'Invalid address (to/cc/bcc): %s' when the recipient address fails static::validateAddress() (default: PCRE-based check, or an injected validator). The kind is echoed in the message. Like other address errors it only throws when $this->exceptions is true, otherwise it records the error and returns false.
Solutions
- Validate with PHPMailer::validateAddress($email) before adding and surface a friendly error to the user
- Split comma/semicolon-separated recipient strings with a parser (or use RFC 822 parsing) before addAddress
- Strip whitespace, newlines, and angle brackets before passing the address
- Check/replace a custom $validator override that may be too strict
- Ensure ext-intl/idn_to_ascii works if using unicode domains, or pre-convert to punycode
Example fix
// before
$mail->addAddress($_POST['recipients']); // 'a@x.com, b@y.com'
// after
foreach (array_filter(array_map('trim', explode(',', $_POST['recipients']))) as $rcpt) {
if (!PHPMailer::validateAddress($rcpt)) {
continue; // or collect and report
}
$mail->addAddress($rcpt);
} Defensive patterns
Strategy: validation
Validate before calling
foreach ($recipients as $r) { if (!PHPMailer::validateAddress(trim($r))) { throw new InvalidArgumentException("Invalid recipient: $r"); } } Type guard
function isValidEmail(mixed $v): bool { return is_string($v) && PHPMailer::validateAddress(trim($v)); } Try / catch
try { $mail->send(); } catch (PHPMailer\PHPMailer\Exception $e) { if (str_contains($e->getMessage(), 'Invalid address')) { log_invalid_recipient($e->getMessage()); } throw $e; } Prevention
- Validate at the boundary (forms/APIs) with PHPMailer::validateAddress or FILTER_VALIDATE_EMAIL
- Reject comma-separated strings; parse into individual addresses
- Sanitize by trimming and stripping whitespace/newlines/angle brackets
- Review any custom $validator override
When it happens
Trigger: $mail->addAddress($addr)/addCC/addBCC where $addr is empty, lacks a domain, contains illegal characters, or otherwise fails validateAddress(); also when queued recipients are replayed in preSend and fail validation.
Common situations: Form input not validated server-side, placeholder strings left in config ('user@example' with no TLD is actually valid to the regex but 'foo@' is not), comma-separated lists passed as a single address, or a custom validator injected via PHPMailer::$validator rejecting legitimate addresses.
Understand the failure class
Background: "invalid id" errors: invalid identifier format — why libraries reject IDs before lookup, and how to fix them — this error's family across 37 libraries.
Related errors
AI-assisted analysis of ellite/Wallos@52820e87ca (2026-09-13).
Data as JSON: /api/errors/e345a4d650011a3c.
Report an issue: GitHub.
Appendix: source
Thrown at libs/PHPMailer/PHPMailer.php:1181
$this->setError($error_message);
$this->edebug($error_message);
if ($this->exceptions) {
throw new Exception($error_message);
}
return false;
}
if (!static::validateAddress($address)) {
$error_message = sprintf(
'%s (%s): %s',
$this->lang('invalid_address'),
$kind,
$address
);
$this->setError($error_message);
$this->edebug($error_message);
if ($this->exceptions) {
throw new Exception($error_message);
}
return false;
}
if ('Reply-To' !== $kind) {
if (!array_key_exists(strtolower($address), $this->all_recipients)) {
$this->{$kind}[] = [$address, $name];
$this->all_recipients[strtolower($address)] = true;
return true;
}
} elseif (!array_key_exists(strtolower($address), $this->ReplyTo)) {
$this->ReplyTo[strtolower($address)] = [$address, $name];
return true;
}
return false;View on GitHub (pinned to 52820e87ca)