Re: What if this code is right ? It worked perfectly for years!!

From: Date: Thu, 27 Aug 2009 00:59:42 +0000
Subject: Re: What if this code is right ? It worked perfectly for years!!
References: 1  Groups: php.general 
Request: Send a blank email to php-general+get-297331@lists.php.net to get a copy of this message
> <? >  $fName = $_REQUEST['fName'] ; >  $emailid = $_REQUEST['emailid'] ; >    $number = $_REQUEST['number'] ; >  $message = $_REQUEST['message'] ; > >  mail( "chris@gmail.com", $number, $message, "From: $emailid" ); >  header( "Location: > http://www.thankyou.com/thankYouContact.php" ); > ?> This is a bit of a hang-up of mine so forgive me if it's mildly OT, but if you do figure out what the problem is, and fix it, you may want to revisit this code in a more extensive way, if what you've pasted above is exactly the code you use in your live application. Please ignore if you've simplified the code above for simplicity's sake. At any rate the code above is most likely vulnerable to SMTP injection, because it passes the unfiltered value of '$emailid' as part of the 'additional_headers' argument to mail(). So the form could be used to send spam to arbitrary email addresses. I'd recommend using filter_input(), with the FILTER_VALIDATE_EMAIL filter, to get at the 'emailid' parameter: http://us3.php.net/manual/en/function.filter-input.php Ben

« previous php.general (#297331) next »