$message - yes
---------------
This usually can go without any special escaping, unless you have
certain headers (the Boundary: header) or allow an injection into
the $additional_headers field. If this is the case a malicious
user could attach a virus to be sent anonymously.
Shouldn't you also worry about html script tags in the body of an HTML email? Couldn't a person also use those to send you a nasty "present"?
$additional_headers - yes
-------------------------
As with $to, $subject you need to make sure \r and/or \n are
removed or escaped properly. The most common used header is the
From header:
From: "$fromname" <$fromemail>
As noted in the $message section, if you have dont take care in
ensuring this paramater isn't done correctly you could potentially
allow the user to setup their own Boundary: header, which then
would allow them to freely make what ever attachments they like.
Also this is where the open (well psudo open) relay occurs, if you
dont filter things properly, you can open up the CC: and BCC:
headers, allowing the person to anonymously send emails.
why would a person allow a user to input header information on a web form? That sounds like a HUGE security hole or is there someway I just can't see?
--
--------------------------------
life is a game... so have fun.