E-mail injection question
| From: | Gary | Date: | Sun, 21 Nov 2010 17:02:58 +0000 |
| Subject: | E-mail injection question | ||
| Groups: | php.general | ||
| Request: | Send a blank email to php-general+get-309595@lists.php.net to get a copy of this message | ||
I have been testing various scripts to kill email injection attacks. I
adapted this script and it seems to work well. Does anyone see any issues
with this?
<?php
$newlinecounter = 0;
foreach($_POST as $key => $val_newline){
if(stristr($val_newline, '\r')){$newlinecounter++;}
if(stristr($val_newline, '\n')){$newlinecounter++;}
if(stristr($val_newline, '\\r')){$newlinecounter++;}
if(stristr($val_newline, '\\n')){$newlinecounter++;}
if(stristr($val_newline, '\r\n')){$newlinecounter++;}
if(stristr($val_newline, '\\r\\n')){$newlinecounter++;}
if(stristr($val_newline, 'Bcc')){$newlinecounter++;}
}
if ($newlinecounter >= 1){ die('die scum die');
}
?>
Thank you,
Gary
__________ Information from ESET Smart Security, version of virus signature database 5636 (20101121)
__________
The message was checked by ESET Smart Security.
http://www.eset.com