Re: Spam using email on website
| From: | Nisse Engström | Date: | Fri, 10 Nov 2006 11:10:40 +0000 |
| Subject: | Re: Spam using email on website | ||
| References: | 1 2 | Groups: | php.general |
| Request: | Send a blank email to php-general+get-244461@lists.php.net to get a copy of this message | ||
On Tue, 7 Nov 2006 13:14:54 -0600 (CST), "Richard Lynch" wrote:
> The Bad Guys are probably cramming your $subject and $from data with
> an ENTIRE eamil, so your mail() function is, in effect, and Open
> Relay. (That's very very very bad.)
>
> Example:
> Normal Input
> $subject = "Hi!";
>
> Bad Guy Input
> $subject = "Hi!\r\nCc: victim1@example.com\r\nvictim2@example.com";
>
> If you do:
> mail($to, $subject, $body);
>
> then you are letting THEM control the headers of your email, which
> lets them splice in 1000 recipients to their junk.
Have you actually tried this? I set up a dummy
sendmail program that logs its input to a file,
and it turned out that PHP's mail() function
converts control characters to white space.
More specifically, it performed the following
conversions (PHP 5.0.2 on Windows 98SE):
To: and Subject:
----------------
\x00 -> Terminates string.
\x01-\x1f -> Replaced by \x20.
\x20-\x7e -> Passed through.
\x7f -> Replaced by \x20.
\x80 -> Passed through.
\x81 -> Replaced by \x20.
\x82-\x8c -> Passed through.
\x8d -> Replaced by \x20.
\x8e -> Passed through.
\x8f-\x90 -> Replaced by \x20.
\x91-\x9c -> Passed through.
\x9d -> Replaced by \x20.
\x9e-\xff -> Passed through.
Body:
-----
\x00 -> Terminates string.
\x01-\xff -> Passed through.
--nfe