note 95573 deleted from function.mail by danbrown

Note Submitter: orrd101 at gmail dot com ---- Don't use the code suggested by Alex M. below to try to prevent injection attacks. There are all sorts of problems with that code since it rejects any submitted form data with any of those strings (someone might legitimately want to write "to:" in their message text, and that's fine). It also fails to detect attacks that don't use those specific headers. It also uses eregi() when a simple strpos() would do (regular expressions are very slow, never use them if a simple string search will do). There are examples for properly avoiding injection attacks in other comments on this page.