note 95652 deleted from function.mail by thiago

Note Submitter: Alberto Hernndez de la Huerta ---- Greetings from HerniHost, The code above (written by Victor Benincasa), posted by Alex M., is a good and very simple way to prevent header injection, but I would like to suggest a little variation. Because the function "eregi" is going to be deprecated on PHP 6, I suggest use the function "stristr", which in this case can be use to do the same function. Note: In the function "stristr", parameters are in different order. "stristr" example => stristr($value, "FROM:"); "eregi" example => eregi("FROM:", $value); Full example using Victor Benincasa's code, but using my own code formatting (for me, this way is much easier to read): <?php foreach($_REQUEST as $fields => $value) { if(stristr($value, "FROM:") || stristr($value, "TO:") || stristr($value, "CC:") || stristr($value, "CCO:") || stristr($value, "Content-Type")) { // I prefer to set a control variable to do something later $form_error = 99; // In my case 99 means "Critical Error" // But if you preffer you can use directly the function "exit" and show a warning message (remember to remove //) //exit("ERROR: Code injection attempt denied! Please don't use the following sequences in your message: 'FROM:', 'TO:', 'CC:', 'CCO:' or 'Content-Type'."); } } ?> --- Best regards, Alberto Hernández de la Huerta http://www.hernihost.com