Sending Email Attachments Safely Through MODxMailer

Attaching uploaded files to email sounds simple until the first send fails. In many older Evo handlers the mistake is always the same: the full $_FILES array is passed directly into the mailer instead of the actual uploaded file path.

The source code looked roughly like this:

$modx->loadExtension('MODxMailer');
$attachments = $_FILES['file'];
$modx->mail->AddAttachment($attachments);
$modx->mail->send();

Why this breaks

AddAttachment() expects a file path, not the raw upload array. In other words, the mailer needs something like $_FILES['file']['tmp_name'] or a moved permanent file path.

Correct idea

$tmp = $_FILES['file']['tmp_name'];
$name = $_FILES['file']['name'];
$modx->mail->AddAttachment($tmp, $name);

Even better

Move the upload to a controlled directory first, validate the extension and size, and only then attach the final file. That gives you clearer error handling and avoids surprises from temporary upload state.

Checklist

• Verify the upload field exists and contains no PHP upload error.
• Pass a real file path to the mailer.
• Use the original file name only as a display name, not as a trusted storage name.
• Clean up temporary files if your workflow does not keep them.

Most attachment bugs in Evo mail handlers are not mailer bugs at all. They are simply incorrect assumptions about what the upload array contains and what the mail API actually expects.