A way to block SMTP injections
| From: | Brian Dunning | Date: | Thu, 16 Feb 2006 19:05:13 +0000 |
| Subject: | A way to block SMTP injections | ||
| Groups: | php.general | ||
| Request: | Send a blank email to php-general+get-230569@lists.php.net to get a copy of this message | ||
I created a simple mail form and am blocking SMTP injections like this. Seems like it ought to be 100% foolproof, AFAIK you can't complete and SMTP injection with a Content-Type header in there. Any opinions?
$body = 'Name: '.$_POST['name'].'\r\n';
$body = $body.'Phone: '.$_POST['phone'].'\r\n';
$body = $body.'Email: '.$_POST['email'].'\r\n';
$body = $body.'Comment: '.$_POST['comment'];
if(!strpos(strtolower($body), 'content-type')) {
mail($email_address, "Site Feedback", $body, "From: ".$email_address);
}
Too simple to be true?