note 56849 added to function.mail

We had a problem with Email Injection Hijacks and came up with the following solution. We had TEXTAREA fields that we needed to keep the cr/lf combinations and could not use the "\r" and "\n" checking. So instead, we removed the colon from every field that was going to be used in the mail function. $from=replace($_POST["sender"] , ":" , ""); $message=replace($_POST["message"] , ":" , ""); I know that the recipient of the form would still receive the email – but the hacker would not be able to include any other headers. The added benefit is that you can keep the formatting of the TEXTAREA fields (with the removal of the colons) An interesting side effect is that you will also know if someone is trying to hack your form. ---- Manual Page -- http://www.php.net/manual/en/function.mail.php Edit -- http://master.php.net/manage/user-notes.php?action=edit+56849 Delete: added to the manual -- http://master.php.net/manage/user-notes.php?action=delete+56849&report=yes&reason=added+to+the+manual Delete: bad code -- http://master.php.net/manage/user-notes.php?action=delete+56849&report=yes&reason=bad+code Delete: spam -- http://master.php.net/manage/user-notes.php?action=delete+56849&report=yes&reason=spam Delete: useless -- http://master.php.net/manage/user-notes.php?action=delete+56849&report=yes&reason=useless Delete: non-english -- http://master.php.net/manage/user-notes.php?action=delete+56849&report=yes&reason=non-english Delete: already in docs -- http://master.php.net/manage/user-notes.php?action=delete+56849&report=yes&reason=already+in+docs Delete: other reasons -- http://master.php.net/manage/user-notes.php?action=delete+56849&report=yes Reject -- http://master.php.net/manage/user-notes.php?action=reject+56849&report=yes Search -- http://master.php.net/manage/user-notes.php