note 56849 deleted from function.mail by mazzanet

Note Submitter: Raymond Davey ---- We had a problem with Email Injection Hijacks and came up with the following solution. We had TEXTAREA fields that we needed to keep the cr/lf combinations and could not use the "\r" and "\n" checking. So instead, we removed the colon from every field that was going to be used in the mail function. $from=replace($_POST["sender"] , ":" , ""); $message=replace($_POST["message"] , ":" , ""); I know that the recipient of the form would still receive the email – but the hacker would not be able to include any other headers. The added benefit is that you can keep the formatting of the TEXTAREA fields (with the removal of the colons) An interesting side effect is that you will also know if someone is trying to hack your form.