note 59640 deleted from ref.mail by didou
| From: | didou@php.net | Date: | Sun, 23 Apr 2006 22:35:36 +0000 |
| Subject: | note 59640 deleted from ref.mail by didou | ||
| References: | 1 | Groups: | php.notes |
| Request: | Send a blank email to php-notes+get-109212@lists.php.net to get a copy of this message | ||
Note Submitter: appel att nr78 dott net
----
Another modest attempt at tackling those pesky mailheader injections. Works quite well for me as it
is, but i would appreciate any suggestions to improve it:
<?php
/* name: input_check_mailinj()
* sample usage: foreach($_POST as $value) input_check_mailinj($value);
*/
function input_check_mailinj($value)
{
# mail adress(ess) for reports...
$report_to = "abuse@yourdomain.com";
# array holding strings to check...
$suspicious_str = array
(
"content-type:"
,"charset="
,"mime-version:"
,"multipart/mixed"
,"bcc:"
);
// remove added slashes from $value...
$value = stripslashes($value);
foreach($suspicious_str as $suspect)
{
# checks if $value contains $suspect...
if(eregi($suspect, strtolower($value)))
{
// replace this with your own get_ip function...
$ip = (empty($_SERVER['REMOTE_ADDR'])) ? 'empty'
: $_SERVER['REMOTE_ADDR'];
$rf = (empty($_SERVER['HTTP_REFERER'])) ? 'empty'
: $_SERVER['HTTP_REFERER'];
$ua = (empty($_SERVER['HTTP_USER_AGENT'])) ? 'empty'
: $_SERVER['HTTP_USER_AGENT'];
$ru = (empty($_SERVER['REQUEST_URI'])) ? 'empty'
: $_SERVER['REQUEST_URI'];
$rm = (empty($_SERVER['REQUEST_METHOD'])) ? 'empty'
: $_SERVER['REQUEST_METHOD'];
# if so, file a report...
if(isset($report_to) && !empty($report_to))
{
@mail
(
$report_to
,"[ABUSE] mailinjection @ " .
$_SERVER['HTTP_HOST'] . " by " . $ip
,"Stopped possible mail-injection @ " .
$_SERVER['HTTP_HOST'] . " by " . $ip .
" (" . date('d/m/Y H:i:s') . ")\r\n\r\n" .
"*** IP/HOST\r\n" . $ip . "\r\n\r\n" .
"*** USER AGENT\r\n" . $ua . "\r\n\r\n" .
"*** REFERER\r\n" . $rf . "\r\n\r\n" .
"*** REQUEST URI\r\n" . $ru . "\r\n\r\n" .
"*** REQUEST METHOD\r\n" . $rm . "\r\n\r\n" .
"*** SUSPECT\r\n--\r\n" . $value . "\r\n--"
);
}
# ... and kill the script.
die
(
'Script processing cancelled: string
(
<em>'.$value.'</em>) contains text portions that
are potentially harmful to this server. <em>Your input
has not been sent!</em> Please use your browser\'s
back-button to return to the previous page and try
rephrasing your input.</p>'
);
}
}
}
?>