Re: Help Defending against Email Injection Attacks
| From: | Liam Delahunty | Date: | Mon, 06 Feb 2006 16:36:34 +0000 |
| Subject: | Re: Help Defending against Email Injection Attacks | ||
| References: | 1 | Groups: | php.general |
| Request: | Send a blank email to php-general+get-229965@lists.php.net to get a copy of this message | ||
> On 2/6/06, Jim Moseby wrote:
> Is it time to abandon using mail() for all user contributed data?
Sort of. Don't write any user input to the headers.
Send the data to a default address, don't include anything in the
subject or the headers from the input and you'll avoid the problems.
--
Kind regards,
Liam