note 95688 added to function.mail

Greetings from HerniHost, The code above (written by Victor Benincasa), posted by Alex M., is a good and very simple way to prevent header injection, but I would like to suggest a little variation. Because the function "eregi" is going to be deprecated on PHP 6, I suggest use the function "stristr", which in this case can be use to do the same function. Note: In the function "stristr", parameters are in different order. "stristr" example => stristr($value, "FROM:"); "eregi" example => eregi("FROM:", $value); Full example using Victor Benincasa's code, but using my own code formatting (for me, this way is much easier to read): <?php foreach($_REQUEST as $fields => $value) { if(stristr($value, "FROM:") || stristr($value, "TO:") || stristr($value, "CC:") || stristr($value, "CCO:") || stristr($value, "Content-Type")) { // I prefer to set a control variable to do something later $form_error = 99; // In my case 99 means "Critical Error" // But if you prefer you can use directly the function "exit" and show a warning message (remember to remove //) //exit("ERROR: Code injection attempt denied! Please don't use the following sequences in your message: 'FROM:', 'TO:', 'CC:', 'CCO:' or 'Content-Type'."); } } ?> --- Best regards, Alberto Hernández de la Huerta HerniHost ---- Server IP: 69.147.83.197 Probable Submitter: 88.23.36.93 ---- Manual Page -- http://www.php.net/manual/en/function.mail.php Edit -- https://master.php.net/note/edit/95688 Del: integrated -- https://master.php.net/note/delete/95688/integrated Del: useless -- https://master.php.net/note/delete/95688/useless Del: bad code -- https://master.php.net/note/delete/95688/bad+code Del: spam -- https://master.php.net/note/delete/95688/spam Del: non-english -- https://master.php.net/note/delete/95688/non-english Del: in docs -- https://master.php.net/note/delete/95688/in+docs Del: other reasons-- https://master.php.net/note/delete/95688 Reject -- https://master.php.net/note/reject/95688 Search -- https://master.php.net/manage/user-notes.php