note 69754 added to function.mail

An important rule of thumb, because it seems few really follow it and it can alleviate so many headaches: When filtering your email headers for injection characters use a regular expression to judge whether the user's input is valid. For example to see if the user entered a valid e-mail address use something like [a-zA-Z0-9._%-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,4}. Dont try to filter out bad characters (like searching for LF or CR), because you will ALWAYS miss something. You can be sure your application is more secure going this route....provided the regular expression is valid! This same point goes for any sort of form input not just for sending out emails. ---- Server IP: 64.71.164.2 Probable Submitter: 158.118.51.2 (proxied: 1.0 PROXY3) ---- Manual Page -- http://www.php.net/manual/en/function.mail.php Edit -- https://master.php.net/note/edit/69754 Del: integrated -- https://master.php.net/note/delete/69754/integrated Del: useless -- https://master.php.net/note/delete/69754/useless Del: bad code -- https://master.php.net/note/delete/69754/bad+code Del: spam -- https://master.php.net/note/delete/69754/spam Del: non-english -- https://master.php.net/note/delete/69754/non-english Del: in docs -- https://master.php.net/note/delete/69754/in+docs Del: other reasons-- https://master.php.net/note/delete/69754 Reject -- https://master.php.net/note/reject/69754 Search -- https://master.php.net/manage/user-notes.php