note 55256 added to ref.mail

Last night we had a spammer use our form-to-mail system to send spam. I had protected the 'to' field in the function so I couldn't understand how they were using it to send to other people. So, I added tracking information to anyone who posts to the form and they tried again this morning. This is what I found out. They were posting a message within a message. In all the variables sent with the form they had this (they were using another program to post directly to the form): vltrwe@domain.com Content-Type: multipart/mixed; boundary="===============1998658368==" MIME-Version: 1.0 Subject: 9c954098 To: victim@domain.com bcc: victim@domain2.com From: vltrwe@domain.com This is a multi-part message in MIME format. --===============1998658368== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit SPAM MESSAGE HERE. --===============1998658368==-- So, the system, when passed this information in the header of the e-mail thought it was the continuation of the format and it sent the additional email data and thus spam goes out. Clear as mud? I have never seen such a clever, if you will, hacking tool. This is downright devious. Protect ANY variables being sent to ANY function. I am looking for "Content-Type:" since I am sure this is the only way to do this. If it's not, I'll know about it because my tracking data is still there. ---- Manual Page -- http://www.php.net/manual/en/ref.mail.php Edit -- http://master.php.net/manage/user-notes.php?action=edit+55256 Delete: added to the manual -- http://master.php.net/manage/user-notes.php?action=delete+55256&report=yes&reason=added+to+the+manual Delete: bad code -- http://master.php.net/manage/user-notes.php?action=delete+55256&report=yes&reason=bad+code Delete: spam -- http://master.php.net/manage/user-notes.php?action=delete+55256&report=yes&reason=spam Delete: useless -- http://master.php.net/manage/user-notes.php?action=delete+55256&report=yes&reason=useless Delete: non-english -- http://master.php.net/manage/user-notes.php?action=delete+55256&report=yes&reason=non-english Delete: other reasons -- http://master.php.net/manage/user-notes.php?action=delete+55256&report=yes Reject -- http://master.php.net/manage/user-notes.php?action=reject+55256&report=yes Search -- http://master.php.net/manage/user-notes.php