Re: if http_referer is not reliable then how do we ...
| From: | tamouse mailing lists | Date: | Fri, 20 Jan 2012 01:11:47 +0000 |
| Subject: | Re: if http_referer is not reliable then how do we ... | ||
| References: | 1 2 | Groups: | php.general |
| Request: | Send a blank email to php-general+get-316338@lists.php.net to get a copy of this message | ||
On Tue, Jan 17, 2012 at 2:34 AM, marco@behnke.biz <marco@behnke.biz> wrote:
> You should not write the recipients email address in a hidden form, but instead
> read it from a config file. This way you can make sure, that no one alters it.
> Although this won't stop anyone from using the mailform.
Cannot emphasize this enough -- don't allow anyone to submit the
destination addresses to your script.