Re: Newbie Form Question
| From: | Andrew Kreps | Date: | Mon, 07 Aug 2006 21:21:46 +0000 |
| Subject: | Re: Newbie Form Question | ||
| References: | 1 2 3 4 | Groups: | php.general |
| Request: | Send a blank email to php-general+get-240285@lists.php.net to get a copy of this message | ||
Better yet, don't allow the user to enter a From address. Simply give
them subscribe and unsubscribe radio buttons, and make sure the
un/subscribe-ee gets a confirmation email. And certainly check your
input fields for newlines. :)
On 8/7/06, Richard Lynch <ceo@l-i-e.com> wrote:
On Mon, August 7, 2006 2:37 am, David Dorward wrote: Richard Lynch wrote:switch($_REQUEST['email']){ case 'subscribe@lists.php.net': case 'unsubscribe@lists.php.net':<?php//Do nothing.break; default:die("Hack attempt.");break; }What if someone submitted: action = poor_spam_victim@example.com email = you@example.org\r\n\r\nA long winded evil spam message here ?if (isset($_REQUEST['email'])){$success = mail($_REQUEST['action'], 'un/subscribe','un/subscribe', "From: $_REQUEST[email]\r\nReply-to: $_REQUEST[email]");if ($success) echo "Status Change Sent"; else echo "Unable to send Status Change";} ?>