note 59478 deleted from ref.mail by didou

Note Submitter: fred at webblake dot net ---- I just thought this would be useful for someone. It's one thing to write your mail forms so they don't support spam via header injection. It's quite another to run a hosting operation with hundreds of web sites that are controlled by different webmasters and customers that do not want to pay to have thier sites fixed. In fact it's very difficult to identify all the buggy sites. As a result, I came up with this little sendmail wrapper. I made this as a cli script and used it as a replacement for sendmail in the php.ini file. Since our web servers have no reason to send BCC and CC Header, this script renames them so they don't work. You would also need to write a script to clean up the temporary files. This script could save messages that were spamming attempts so you can study them later. It would just look for the replacement headers to determine if it was a spamming attempt. <?php $tmpfile = "/tmp/" . uniqid('') . ".mail"; $fp = fopen($tmpfile,"w"); fwrite($fp,"x-wls-cc-filter: On\n"); while($line = fgets(STDIN)) { $line = ereg_replace("^bcc:","x-wlsspam-bcc:",$line); $line = ereg_replace("^cc:","x-wlsspam-cc:",$line); fwrite($fp,$line); } fclose($fp); $cmd = '/usr/sbin/sendmail '; for($i = 1 ; $i < $argc; $i++) { $cmd .= $argv[$i]; $cmd .= ' '; } $cmd .= "<$tmpfile"; system($cmd); ?>