Secure Mail Form using PHP
| From: | Martin E. Koss | Date: | Thu, 16 Feb 2006 13:39:30 +0000 |
| Subject: | Secure Mail Form using PHP | ||
| Groups: | php.general | ||
| Request: | Send a blank email to php-general+get-230540@lists.php.net to get a copy of this message | ||
This issue has probably been discussed more than I've been able to find
in the archive, so I'm sorry if I'm going over old ground.
I'm trying to make sure my email form cannot be used for spam or
injecting additional code and addresses in any way.
So far I'm able to remove bcc, cc, to, etc but unable to remove \n & \r.
If I could do that I'd consider it fairly secure. As you'll see below,
I've been trying various ways of doing it.
<snip>
// CHECK FOR SPAM ATTEMPTS AND REMOVE THEM
$Email = stripslashes($Email);
$Senders_Name = stripslashes($Senders_Name);
$Message = stripslashes($Message);
$recipient = stripslashes($recipient);
$subject = stripslashes($subject);
$Email = preg_replace( "/[\n\r]+/", " ", $Email );
// Remove injected headers
$find =
array("/bcc\:/i","/Content\-Type\:/i","/cc\:/i","/to\:/i");
$Email = preg_replace($find, "", $Email);
$Senders_Name = preg_replace($find, "", $Senders_Name);
$Message = preg_replace($find, "", $Message);
$recipient = preg_replace($find, "", $recipient);
// $message = preg_replace($find, "", message);
// $email=str_replace("\r","\n",$email);
// $name=str_replace("\r","\n",$name);
// $message=str_replace("\r","\n",$message);
// $phone=str_replace("\r","\n",$phone);
// $Email = ereg_replace( "\r", " ", $Email ); THIS DOES NOT WORK
// $Email = ereg_replace( "\n", " ", $Email ); THIS DOES NOT WORK
// $Email = ereg_replace( "bcc:", " ", $Email );
// $Email = ereg_replace( "cc:", " ", $Email );
$Senders_Name = preg_replace( "/[\n\r]+/", " ", $Senders_Name );
$Message = preg_replace( "/[\n\r]+/", " ", $Message );
$recipient = preg_replace( "/[\n\r]+/", " ", $recipient );
$subject = preg_replace( "/[\n\r]+/", " ", $subject );
</snip>
<snip>
// NOW SEND THE EMAIL
mail("$recipient", "$subject.", $Message,
"From: $Email ($Senders_Name)\nReply-To: $Email\n
Sent by: $Senders_Name
Email Address: $Email");
</snip>
Thanks for any guidance....
Martin