note 55111 deleted from function.mail by danbrown

Note Submitter: jfonseca at matarese dot com ---- This is NOT PHP-specific but worth mentioning on the mail() page. Watch out for sendmail command injection on your pages which call the mail() function. How it works: the attacker will inject SMTP into your form unless you make it real clear where the header ends. Most people simply don't add a header or a \r\n\r\n sequence to their mail header forms. Example : a new BCC: field can be injected so that your form can be used to deliver mail to any valid address the attacker chooses. Since the httpd server host is a trusted host your MX will probably relay without asking any questions. Be careful with any function that accepts user input. Hope this helps.