Sending email to 2 email addresses

Actually the email_to value in the shortcode attributes does not appear to be sanitized but it is validated using is_email, which will reject a list.

I think you need to add a custom cleanup function to apply to the email_to attribute, something like the (untested) code below. The idea is that it breaks the string at commas into an array, validates each address separately and generates an array containing only the valid addresses. The result could be an empty array. wp_mail will take a string or an array as the $to value.

You could use this for CC and BCC fields, adding them to the $header array.

Note that the email_settings value should never be a list because you want the FROM: field to be a single address, so the sanitization you have there is correct.

This is code that could go in vscf-submission.php

<?php
function email_list_array( $list ) {
    $clean_list = array();
    if ( $list !== '' ) {
        $emails = explode( ',', $list );
        // Build the TO array from valid addresses in the list.
        foreach ( $emails as $email ) {
            $clean = sanitize_email( $email );
            if ( is_email( $clean ) ) {
                $clean_list[] = $clean;
            }
        }
    }
    return $clean_list;
}

// In vscf-submission.php
    $email_admin = get_option('admin_email');
    $email_settings = get_option('vscf-setting-22');
    $email_to = email_list_array( $vscf_atts['email_to'] );
    $from_header = $vscf_atts['from_header'];
    // email address admin
    if ( count( $email_to) ) {
        $to = $email_to;
    } else {
        if ( is_email( $email_settings ) ) {
            $to = $email_settings;
        } else {
            $to = $email_admin;
        }
    }

Good point. I guess the cleanup function could stop once it’s got 3 addresses, or whatever you set as the limit.

if ( is_email( $clean ) ) {
    $clean_list[] = $clean;
    if ( count( $clean_list ) >= 3 ) break;
}

I use this plugin quite a bit for club websites where the email goes to several members of the management committee. They’re all volunteers so the hope is that at least one person will respond! So even if you use CC or BCC, you still might want it to go to several recipients.

In the single address case for attribute you should have:
$to = $email_clean;
otherwise you’re checking the sanitized version but using the the non-sanitized version.

Apart from that everything looks good to me. I like the new variable names too 🙂

if (strpos($email_to_attribute, ',') == true)
is perfectly correct, but strpos will never actually return true, only false or an integer. I prefer !== false, but that’s just a personal style thing.

Simon