Re: security issue with mail()

>I tried to create a formmail in PHP (as my first proggie) and the server >returned a warning like that: >"mail() has been disabled for security reasons" >so I contacted my webhost and they said mail() has been disabled because >it has a security flaw. >It allows the PHP script to access any file on the server including other >virtual hosts. >Is that true?? I think it more likely that they disabled all the file functions for that reason, and mail() so you can't send spam. I don't *think* mail() would allow you to access any file whatsoever... What they may not realize is that you can *maybe* use something like Manuel Lemos' class to "talk" directly to their mail server port 25 and send email that way, bypassing PHP's builtin mail() function entirely. OTOH, if they were smart enough and vigilant enough to disable the file and mail() functions, they may have their port 25 locked down somehow to block you as well, or disabled the socket functions in PHP. On the plus side, you have an ISP who obviously cares enough about security to do something about it... Still, if you *need* mail(), you may need to consider another ISP or co-locating your own server set up the way *you* want it. If budget is your primary concern, try http://php.net/links.php (two links to databases of PHP ISP's listed) or http://www.budgetweb.com for price and feature based searches, but no PHP-specific flag last time I checked :-(