note 95287 deleted from function.mail by danbrown
| From: | danbrown@php.net | Date: | Thu, 24 Dec 2009 00:47:09 +0000 |
| Subject: | note 95287 deleted from function.mail by danbrown | ||
| References: | 1 | Groups: | php.notes |
| Request: | Send a blank email to php-notes+get-164296@lists.php.net to get a copy of this message | ||
Note Submitter: dsbeam at gmail dot com
----
To improve Alex M.'s example:
<?php
foreach($_REQUEST as $fields => $value)
{
if(preg_match("/((TO|CC|CCO)\:)|Content\-Type/i", $value))
{
exit("ERROR: Code injection attempt denied! Please don't use the following
sequences in your message: 'TO:', 'CC:', 'CCO:' or
'Content-Type'.");
}
}
?>
This is not deprecated in PHP 5.3 (all ereg functions are as of this release) and does the whole
regular expression in one line (one of the coolest parts of using them!).