note 62027 added to ref.mail

Suggestion for methods checking form inputs for e-mail injection attempts. Any inputs expected from single-line text fields can just be refused if they contain a newline character. The second function tries to minimize matches on non-evil inputs by matching suspect strings only if preceded by a newline character. (Anyway, if this is considered to be safe, it will of course do it for single-line inputs, too.) <?php /** * Check single-line inputs: * Returns false if text contains newline character */ function has_no_newlines($text) { return preg_match("/(%0A|%0D|\\n+|\\r+)/i", $text) == 0; } /** * Check multi-line inputs: * Returns false if text contains newline followed by * email-header specific string */ function has_no_emailheaders($text) { return preg_match("/(%0A|%0D|\\n+|\\r+)(content-type:|to:|cc:|bcc:)/i", $text) == 0; } ?> ---- Server IP: 194.153.94.11 Probable Submitter: 213.180.171.13 ---- Manual Page -- http://www.php.net/manual/en/ref.mail.php Edit -- http://master.php.net/manage/user-notes.php?action=edit+62027 Delete: added to the manual -- http://master.php.net/manage/user-notes.php?action=delete+62027&report=yes&reason=added+to+the+manual Delete: bad code -- http://master.php.net/manage/user-notes.php?action=delete+62027&report=yes&reason=bad+code Delete: spam -- http://master.php.net/manage/user-notes.php?action=delete+62027&report=yes&reason=spam Delete: useless -- http://master.php.net/manage/user-notes.php?action=delete+62027&report=yes&reason=useless Delete: non-english -- http://master.php.net/manage/user-notes.php?action=delete+62027&report=yes&reason=non-english Delete: already in docs -- http://master.php.net/manage/user-notes.php?action=delete+62027&report=yes&reason=already+in+docs Delete: other reasons -- http://master.php.net/manage/user-notes.php?action=delete+62027&report=yes Reject -- http://master.php.net/manage/user-notes.php?action=reject+62027&report=yes Search -- http://master.php.net/manage/user-notes.php