note 62875 added to function.mail

As noted in other, well, notes; the "additional headers" parameter can be easily exploited, when doing things like: <?php mail( $_POST['to'], $_POST['subject'], $_POST['message'], 'Reply-to: '.$_POST['from']."\r\n" ); ?> An easy way of fixing this, is removing CRLFs from the header-strings, like so: <?php $_POST['from'] = str_replace( "\r\n", '', $_POST['from'] ); ?> This way, the extra data will be part of the previous header. ---- Server IP: 84.18.202.180 Probable Submitter: 62.252.32.11 (proxied: 81.106.141.225) ---- X-Spam-Status: No, hits=3.1 required=5.0 tests=DATE_MISSING,FROM_NO_LOWER autolearn=no version=2.64 ---- Manual Page -- http://www.php.net/manual/en/function.mail.php Edit -- http://master.php.net/note/edit/62875 Del: integrated -- http://master.php.net/note/delete/62875/integrated Del: useless -- http://master.php.net/note/delete/62875/useless Del: bad code -- http://master.php.net/note/delete/62875/bad+code Del: spam -- http://master.php.net/note/delete/62875/spam Del: non-english -- http://master.php.net/note/delete/62875/non-english Del: in docs -- http://master.php.net/note/delete/62875/in+docs Del: other reasons-- http://master.php.net/note/delete/62875 Reject -- http://master.php.net/note/reject/62875 Search -- http://master.php.net/manage/user-notes.php