Re: Block email inject spammers

"Gordon Burditt" <gordonb.eiwt9@xxxxxxxxxxx> wrote in message
news:11uf04s9ocmvc08@xxxxxxxxxxxxxxxxxxxxx

if (ereg(":", $Name)) || (ereg(":", $From))

If I validate my mail() headers thus, will this stop spammers being
able to abuse my mail form? If there is somebody who has a colon in
their name or email address, I have yet to meet them.

Do not permit any variable used in constructing the arguments
to the mail() function to contain line ending characters (\r or \n)
except for the message body, and that only after you have provided
a blank line to separate the headers from the body. You check
this with PHP, *not* javascript (which can be removed from the
spammer's copy of the form).

Do not allow the form to specify any part of the to: or cc: address.

Hi Gordon,

Thanks for your input. I only have three user fields in the form. If I
expand the colon removal to all three fields that'll do the trick
won't it? They need the colon to inject spurious cc: or bcc:
addresses.

Many thanks

Franc


.

Relevant Pages

  • Re: Gateway Upgraded
    ... TMail is doing the headers. ... break directly after the colon). ... library for Usenet posts. ... Usenet and mail use the same generic message format (RFC ...
    (comp.lang.ruby)
  • Re: Block email inject spammers
    ... If I validate my mailheaders thus, ... able to abuse my mail form? ... If there is somebody who has a colon in ... except for the message body, and that only after you have provided ...
    (comp.lang.php)
  • Re: [SLE] 10.0: no 3D support, nvidia driver update unsuccessful?
    ... no colon:, but this way ... direct rendering: Yes ... Paul Cartwright ... Check the headers for your unsubscription address ...
    (SuSE)
  • Re: Block email inject spammers
    ... except for the message body, and that only after you have provided ... expand the colon removal to all three fields that'll do the trick ... How many different characters are there in Unicode ... Even if you aren't using a Windows mail server, ...
    (comp.lang.php)