note 56788 deleted from function.mail by cmb

Note Submitter: GwarDrazul ---- The article mentioned below is quite good to understand the problem of header injection. However, it suggests the following as a solution: look for "\n" and "\r" inside your user input fields (especially in those used for the $header param) and, if found reject the mail. Allthough this will probably work I still believe it is better to have a "white list" of allowed characters instead of a "black list" with forbidden characters. Example: If you want a user to enter his name, then allow characters only! If you want a user to enter his email adress, then check if the entry is a valid email adress. Doing so might automatically solve problems which you didn't think of when you created the "black list". For SMTP headers colons are needed. If you check for a valid email adress the hacker won't be able to enter colons inside that form field. I suggest using regular expressions for those checks. For more information about regular expressions see: http://www.regular-expressions.info/