note 95573 added to function.mail

Don't use the code suggested by Alex M. below to try to prevent injection attacks. There are all sorts of problems with that code since it rejects any submitted form data with any of those strings (someone might legitimately want to write "to:" in their message text, and that's fine). It also fails to detect attacks that don't use those specific headers. It also uses eregi() when a simple strpos() would do (regular expressions are very slow, never use them if a simple string search will do). There are examples for properly avoiding injection attacks in other comments on this page. ---- Server IP: 69.147.83.197 Probable Submitter: 75.54.86.38 ---- Manual Page -- http://www.php.net/manual/en/function.mail.php Edit -- https://master.php.net/note/edit/95573 Del: integrated -- https://master.php.net/note/delete/95573/integrated Del: useless -- https://master.php.net/note/delete/95573/useless Del: bad code -- https://master.php.net/note/delete/95573/bad+code Del: spam -- https://master.php.net/note/delete/95573/spam Del: non-english -- https://master.php.net/note/delete/95573/non-english Del: in docs -- https://master.php.net/note/delete/95573/in+docs Del: other reasons-- https://master.php.net/note/delete/95573 Reject -- https://master.php.net/note/reject/95573 Search -- https://master.php.net/manage/user-notes.php