Re: Sending Mail with PHP
| From: | John W. Holmes | Date: | Thu, 06 May 2004 15:51:30 +0000 |
| Subject: | Re: Sending Mail with PHP | ||
| References: | 1 | Groups: | php.general |
| Request: | Send a blank email to php-general+get-185536@lists.php.net to get a copy of this message | ||
From: "Justin @ Dreaming in TO" <justin@dreaminginto.com>
> If you go to
> http://www.functionjunkie.org/contactform/contactform.php
> and fill out the form, it sends the email ok, but its supposed to
> redirect to a preset page, which it does.
>
> However, the page it redirects to is blank, except for the background
> image that is referenced in the CSS stylesheet. Feel free to test it as
> many times as you would like.
[snip]
> mail($mailto, $subject, $messageproper, "From: \"$name\"
> <$email>\nReply-To: \"$name\" <$email>\nX-Mailer: FunctionJunkie
> WebMailer" );
> exit ;
1. I don't see where you're redirecting anywhere after you send the mail().
2. You have output on line 7 of feedback.php, which means your header()
redirects will fail, anyhow.
3. This script is vulnerable to mail header injection attacks because you do
not check the user-supplied data for newlines. A maliciously formed $name or
$email value could lead to header injection.
4. You should use \r\n between your additional mail headers.
---John Holmes...