note 94752 deleted from function.mail by cmb
| From: | cmb@php.net | Date: | Fri, 15 May 2015 19:23:26 +0000 |
| Subject: | note 94752 deleted from function.mail by cmb | ||
| References: | 1 | Groups: | php.notes |
| Request: | Send a blank email to php-notes+get-202550@lists.php.net to get a copy of this message | ||
Note Submitter: Alex M.
----
It is important to filter the form input to prevent header injection. Here is a simple way:
<?php
# Anti-header-injection - Use before mail()
# By Victor Benincasa <vbenincasa(AT)gmail.com>
foreach($_REQUEST as $fields => $value) if(eregi("TO:", $value) ||
eregi("CC:", $value) || eregi("CCO:", $value) || eregi("Content-Type",
$value)) exit("ERROR: Code injection attempt denied! Please don't use the following
sequences in your message: 'TO:', 'CC:', 'CCO:' or
'Content-Type'.");
?>
--
Alex M.