note 69869 added to function.getmxrr

If you want to use getmxrr on windows, be careful as choward AT fast DOT net DOT NO SPAM PLZ's function has a security flaw. It passes its argument to an external command without escaping it. If you don't validate the input, someone may manage to run nasty things on your system. Here's a fixed version (just added escapeshellarg()) <?php function getmxrr($hostname, &$mxhosts) { $mxhosts = array(); exec('%SYSTEMDIRECTORY%\\nslookup.exe -q=mx '.escapeshellarg($hostname), $result_arr); foreach($result_arr as $line) { if (preg_match("/.*mail exchanger = (.*)/", $line, $matches)) $mxhosts[] = $matches[1]; } return( count($mxhosts) > 0 ); }//--End of workaround //test.. getmxrr('yahoo.com', $mxhosts); print_r($mxhosts); ?> This way you'll avoid a lot of nasty things ;) ---- Server IP: 195.221.21.36 Probable Submitter: 88.191.19.199 (proxied: unknown) ---- Manual Page -- http://www.php.net/manual/en/function.getmxrr.php Edit -- https://master.php.net/note/edit/69869 Del: integrated -- https://master.php.net/note/delete/69869/integrated Del: useless -- https://master.php.net/note/delete/69869/useless Del: bad code -- https://master.php.net/note/delete/69869/bad+code Del: spam -- https://master.php.net/note/delete/69869/spam Del: non-english -- https://master.php.net/note/delete/69869/non-english Del: in docs -- https://master.php.net/note/delete/69869/in+docs Del: other reasons-- https://master.php.net/note/delete/69869 Reject -- https://master.php.net/note/reject/69869 Search -- https://master.php.net/manage/user-notes.php