note 59012 added to ref.mail

I too have been a victim of BCC header injections. A note to spammers: What a waste of good talent on such pathetic efforts, get a life! Anyway, I have several websites that all use a common contact form. Every contact form posts to the same script. This is how I defend against header injections. (I typically use this script as an include file) This script requires your html form to use action="post". Make sure this is only used on the script that the html form will be posted to. If you use this script on a regular page request, it will die(). * More error checking should be done when testing posted values for bad strings. Possibly a regular expression... <?php // First, make sure the form was posted from a browser. // For basic web-forms, we don't care about anything // other than requests from a browser: if(!isset($_SERVER['HTTP_USER_AGENT'])){ die("Forbidden - You are not authorized to view this page"); exit; } // Make sure the form was indeed POST'ed: // (requires your html form to use: action="post") if(!$_SERVER['REQUEST_METHOD'] == "POST"){ die("Forbidden - You are not authorized to view this page"); exit; } // Host names from where the form is authorized // to be posted from: $authHosts = array("domain.com", "domain2.com", "domain3.com"); // Where have we been posted from? $fromArray = parse_url(strtolower($_SERVER['HTTP_REFERER'])); // Test to see if the $fromArray used www to get here. $wwwUsed = strpos($fromArray['host'], "www."); // Make sure the form was posted from an approved host name. if(!in_array(($wwwUsed === false ? $fromArray['host'] : substr(stristr($fromArray['host'], '.'), 1)), $authHosts)){ logBadRequest(); header("HTTP/1.0 403 Forbidden"); exit; } // Attempt to defend against header injections: $badStrings = array("Content-Type:", "MIME-Version:", "Content-Transfer-Encoding:", "bcc:", "cc:"); // Loop through each POST'ed value and test if it contains // one of the $badStrings: foreach($_POST as $k => $v){ foreach($badStrings as $v2){ if(strpos($v, $v2) !== false){ logBadRequest(); header("HTTP/1.0 403 Forbidden"); exit; } } } // Made it past spammer test, free up some memory // and continue rest of script: unset($k, $v, $v2, $badStrings, $authHosts, $fromArray, $wwwUsed); ?> ---- Manual Page -- http://www.php.net/manual/en/ref.mail.php Edit -- http://master.php.net/manage/user-notes.php?action=edit+59012 Delete: added to the manual -- http://master.php.net/manage/user-notes.php?action=delete+59012&report=yes&reason=added+to+the+manual Delete: bad code -- http://master.php.net/manage/user-notes.php?action=delete+59012&report=yes&reason=bad+code Delete: spam -- http://master.php.net/manage/user-notes.php?action=delete+59012&report=yes&reason=spam Delete: useless -- http://master.php.net/manage/user-notes.php?action=delete+59012&report=yes&reason=useless Delete: non-english -- http://master.php.net/manage/user-notes.php?action=delete+59012&report=yes&reason=non-english Delete: already in docs -- http://master.php.net/manage/user-notes.php?action=delete+59012&report=yes&reason=already+in+docs Delete: other reasons -- http://master.php.net/manage/user-notes.php?action=delete+59012&report=yes Reject -- http://master.php.net/manage/user-notes.php?action=reject+59012&report=yes Search -- http://master.php.net/manage/user-notes.php