[Phpwm] Securing feedback forms

[Phil Beynon]

> > So, basically, as has already been said, run your recipient's address
> > through a regex to make sure it's got no nasty chars (like returns,
> > newlines, less/greater than signs, semi colons etc).
>
> The nasty characters, when using mail() is \r\n (as far as I know) which
> results in a new line being entered when the mail is passed to sendmail
> - which leads to header injection (e.g. cc, bcc etc)
>
> So, strip_tags and trim isn't enough. And addslashes is probably
> useless/pointless in this context.
>
> There's a great article online which covers this - namely :
>
> http://www.securephpwiki.com/index.php/Email_Injection
>
> One way around the problem, is to use PEAR::Mail instead.
>
> thanks
> David.
>
> --
> David Goodwin
>
> [ david at codepoets dot co dot uk ]
> [ http://www.codepoets.co.uk       ]
>

The way I actually handle mailforms, basic or complex, is to make a single
page, the first part being the form, the second the filtering and error
checking, the third the actual sending routine. Each part is actually a
seperate function call, triggered only by the completion sucessfully of the
previous section. All controlled by a conditional switch.
I've used quite a few of these on different sites and I've yet to see one of
these compromised.
They are just too complex for a standard injection routine technique to
operate, if its difficult then the hacker will just move along until they
find somewhere easier.

Phil