note 56788 added to function.mail

The article mentioned below is quite good to understand the problem of header injection. However, it suggests the following as a solution: look for "\n" and "\r" inside your user input fields (especially in those used for the $header param) and, if found reject the mail. Allthough this will probably work I still believe it is better to have a "white list" of allowed characters instead of a "black list" with forbidden characters. Example: If you want a user to enter his name, then allow characters only! If you want a user to enter his email adress, then check if the entry is a valid email adress. Doing so might automatically solve problems which you didn't think of when you created the "black list". For SMTP headers colons are needed. If you check for a valid email adress the hacker won't be able to enter colons inside that form field. I suggest using regular expressions for those checks. For more information about regular expressions see: http://www.regular-expressions.info/ ---- Manual Page -- http://www.php.net/manual/en/function.mail.php Edit -- http://master.php.net/manage/user-notes.php?action=edit+56788 Delete: added to the manual -- http://master.php.net/manage/user-notes.php?action=delete+56788&report=yes&reason=added+to+the+manual Delete: bad code -- http://master.php.net/manage/user-notes.php?action=delete+56788&report=yes&reason=bad+code Delete: spam -- http://master.php.net/manage/user-notes.php?action=delete+56788&report=yes&reason=spam Delete: useless -- http://master.php.net/manage/user-notes.php?action=delete+56788&report=yes&reason=useless Delete: non-english -- http://master.php.net/manage/user-notes.php?action=delete+56788&report=yes&reason=non-english Delete: other reasons -- http://master.php.net/manage/user-notes.php?action=delete+56788&report=yes Reject -- http://master.php.net/manage/user-notes.php?action=reject+56788&report=yes Search -- http://master.php.net/manage/user-notes.php