note 94752 modified in function.mail by danbrown
| From: | danbrown@php.net | Date: | Mon, 23 Nov 2009 15:34:36 +0000 |
| Subject: | note 94752 modified in function.mail by danbrown | ||
| References: | 1 | Groups: | php.notes |
| Request: | Send a blank email to php-notes+get-163195@lists.php.net to get a copy of this message | ||
It is important to filter the form input to prevent header injection. Here is a simple way:
<?php
# Anti-header-injection - Use before mail()
# By Victor Benincasa <vbenincasa(AT)gmail.com>
foreach($_REQUEST as $fields => $value) if(eregi("TO:", $value) ||
eregi("CC:", $value) || eregi("CCO:", $value) || eregi("Content-Type",
$value)) exit("ERROR: Code injection attempt denied! Please don't use the following
sequences in your message: 'TO:', 'CC:', 'CCO:' or
'Content-Type'.");
?>
--
Alex M.
--was--
It is important to filter the form input to prevent header injection. Here is a simple way:
<?php
# Anti-header-injection - Use before mail()
# By Victor Benincasa <vbenincasa(AT)gmail.com>
foreach($_REQUEST as $fields => $value) if(eregi("TO:", $value) ||
eregi("CC:", $value) || eregi("CCO:", $value) || eregi("Content-Type",
$value)) exit("ERROR: Code injection attempt denied! Please don't use the following
sequences in your message: 'TO:', 'CC:', 'CCO:' or
'Content-Type'.");
?>
--
Alex M.
Unihost Brasil (http://unihostbrasil.com.br)
http://php.net/manual/en/function.mail.php