Re: php 'mail()' security

There is no substitute for good data verification such as strip_tags() or some regular expressions to limit valid input. I also would recomend checking the referrer to be sure someone doesn't hijack you form and try to modify it and submit it from a remote location. Here is an example: if (validReferrer() === false) die("invalid referrer"); function validReferrer() { $_valid_referrers = array("www.yoursite.com","www2.yoursite.com","yoursite.com"); $referer = str_replace('//', '/', $_SERVER['HTTP_REFERER']); $ref = explode('/', $referer); if ( in_array($ref[1], $_valid_referrers) ) return true; else return false; } Jim Grill Support Web-1 Hosting http://www.web-1hosting.net ----- Original Message ----- From: "Dennis Gearon" <gearond@cvc.net> To: "Bob Lockie" <bjlockie@lockie.ca> Cc: <php-general@lists.php.net> Sent: Saturday, July 27, 2002 10:54 PM Subject: Re: [PHP] php 'mail()' security > What I meant was, how to sanitize the input on the forms so that > malicious stuff cannot be put as commands, etc. in the email address, or > body, or 'extra' field of the 'mail()' function in PHP. > -- > ----------------------------------------------------------------- > Joy is just a thing (to be).. raised on, > Love is just the way to Live and Die, > John Denver. > ----------------------------------------------------------------- > He lost a friend, but kept his Memory (also John Denver), > Thank you...John Corones...my friend always. > ----------------------------------------------------------------- > Look lovingly upon the present, > for it holds the only things that are forever true. > ----------------------------------------------------------------- > Sincerely, Dennis Gearon (Kegley) > > -- > PHP General Mailing List (http://www.php.net/) > To unsubscribe, visit: http://www.php.net/unsub.php > > >