note 94752 added to function.mail

It is important to filter the form input to prevent header injection. Here is a simple way: <?php # Anti-header-injection - Use before mail() # By Victor Benincasa <vbenincasa(AT)gmail.com> foreach($_REQUEST as $fields => $value) if(eregi("TO:", $value) || eregi("CC:", $value) || eregi("CCO:", $value) || eregi("Content-Type", $value)) exit("ERROR: Code injection attempt denied! Please don't use the following sequences in your message: 'TO:', 'CC:', 'CCO:' or 'Content-Type'."); ?> -- Alex M. Unihost Brasil (http://unihostbrasil.com.br) ---- Server IP: 187.16.23.134 Probable Submitter: 200.161.63.78 ---- Manual Page -- http://www.php.net/manual/en/function.mail.php Edit -- https://master.php.net/note/edit/94752 Del: integrated -- https://master.php.net/note/delete/94752/integrated Del: useless -- https://master.php.net/note/delete/94752/useless Del: bad code -- https://master.php.net/note/delete/94752/bad+code Del: spam -- https://master.php.net/note/delete/94752/spam Del: non-english -- https://master.php.net/note/delete/94752/non-english Del: in docs -- https://master.php.net/note/delete/94752/in+docs Del: other reasons-- https://master.php.net/note/delete/94752 Reject -- https://master.php.net/note/reject/94752 Search -- https://master.php.net/manage/user-notes.php