Home > Developer > Web Develop
PHP e-Mail injection
First, take a look at the PHP code in the section:
<body>
<?php
if (isset ($_request[' email '))
//if "is filled out, send email
{
//send email
$email = $_request[' email '];
$subject = $_request[' subject ');
$message = $_request[' message '];
Mail ("[email protected]", "Subject: $subject",
$message, "from: $email"),
Echo Thank Mail Form ";
}
Else
//if "Email" is not filled out, display the form
{
echo "<form method= ' post ' action= ' Mailform . php ';
Email: <input name= ' email ' type= ' text '/><br/>
Subject: <input name= ' Subject ' type= ' Text '/><br/>
message:<br/>
<textarea name= ' Message ' rows= ' ' cols= ';
</ TEXTAREA><BR/>
<input type= ' submit '/>
</form> ";
}
?
</body>
The problem with the above code is that an unauthorized user can insert data into the header of the message by entering the form.
What happens if the user joins the text in the input box in the form?
[email protected]%0acc:[email protected]
%0abcc:[email protected],[email protected] ,
[email protected],[email protected]
%0abto:bjrongjinhuiyin.com [email protected]
As always, the mail () function puts the gold-and-silver text above into the header of the message, and now the head has an extra Cc:, BCC: And to: Fields. When the user clicks the Submit button, the e-mail will be sent to all the addresses above!
PHP prevents e-mail injection
The best way to prevent e-mail injection is to validate the input.
The following code is similar to the previous section, but we have added an input validator for the email field in the Funding platform detection form:
<body>
<?php
function Spamcheck ($field)
{
//filter_var () sanitizes the e-mail
//address using filter_sanitize_email
$field = Filter_var ($field, Filter_sanitize_email);
//filter_var () validates the e-mail
//address using Filter_validate_email
if (Filter_var ($field, filter _validate_email))
{
return TRUE;
}
Else
{
return FALSE;
}
}
if (isset ($_request[' email '))
{//if "email" is filled out, proceed
Check if the email address is invalid
$mailcheck = Spamcheck ($_request[' email ');
if ($mailcheck ==false)
{
echo "Invalid input";
}
Else
{//send Email
$email = $_request[' email '];
$subject = $_request[' subject ');
$message = $_request[' message '];
Mail ("[email protected]", "Subject: $subject",
$message, "From: $email");
echo "Thank you to using our mail form";
}
}
Else
{//if "email" is not filled out, display the form
echo "<form method= ' post ' action= ' mailform.php ' >
Email: <input name= ' email ' type= ' text '/><br/>
Subject: <input name= ' Subject ' type= ' text '/><br/>
Message:<br/>
<textarea name= ' message ' rows= ' cols= ' >
</textarea><br/>
<input type= ' Submit '/>
</form> ";
}
?>
</body>
PHP Secure e-mail
Start building with 50+ products and up to 12 months usage for Elastic Compute Service
1 on 1 presale consultation
24/7 Technical Support 6 Free Tickets per Quarter Faster Response
Alibaba Cloud offers highly flexible support services tailored to meet your exact needs.
A comprehensive suite of global cloud computing services to power your business
Payment Methods We Support
