Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.lang.php > #9824

Re: FORMS, validating mail was sent

From Jerry Stuckle <jstucklex@attglobal.net>
Newsgroups comp.lang.php
Subject Re: FORMS, validating mail was sent
Date 2013-06-20 17:03 -0400
Organization A noiseless patient Spider
Message-ID <kpvqea$ra9$1@dont-email.me> (permalink)
References <kpveqo$9ag$2@speranza.aioe.org> <afednR-2zbyC917MnZ2dnUVZ_i2dnZ2d@posted.internetamerica>

Show all headers | View raw

On 6/20/2013 4:46 PM, Gordon Burditt wrote:
>> I'm a PHP near-newbie working fairly successfully on creating a secure
>> PHP e-mail (mail()) function. It occurs to me that the only way a user
>> knows (thinks) a form has been sent, is that I tell him so either in a
>> line of code or with a Thank You page.
>
> Since you're a near-newbie, please save the world from having to
> block email from your server, and DO NOT put any variables in email
> headers, DO NOT put any variables from the user in email headers,
> and DO NOT put any variables set in your form in email headers.
> Put them in the body of the mail.
>
> Wrong:		 From: $email
> Right:		 From: www-data@myserver.hostingco.com
>
> Some servers are going to require that (a) the From: address is
> local, (b) the From: address is a valid local user, and perhaps (c)
> the user name must match the user id of the code that called the
> MTA.  In other words, there might be only one correct From: line
> you're allowed to use.
>
> (For a mailing list to customers, you're stuck with a variable
> in the To:, Cc:, or Bcc: headers.  )
>
> Wrong:		Subject: Contact form from $email
> Right:		Subject: Contact form - read body to tell who it's from.
>
> Wrong:		Subject: Order for $itemname
> Right:		Subject: Order
>
>
>
> (Consider what happens if $email='me@gmail.com\rCc: victim1@gmail.com,
> victim2@gmail.com, victim3@gmail.com, ..., victim99@gmail.com', and
> $address (used in the body) contains a 5-page-long ad for body part
> enlargement)
>

I will agree not to put UNVALIDATED data in the Subject: line.  But 
proper validation of the data will solve this problem.

I do agree not to put user-supplied data in the To: or From: fields.

-- 
==================
Remove the "x" from my email address
Jerry Stuckle
JDS Computer Training Corp.
jstucklex@attglobal.net
==================

Back to comp.lang.php | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

FORMS, validating mail was sent Twayne <nobody@spamcop.net> - 2013-06-20 13:40 -0400
  Re: FORMS, validating mail was sent Jerry Stuckle <jstucklex@attglobal.net> - 2013-06-20 13:53 -0400
  Re: FORMS, validating mail was sent "J.O. Aho" <user@example.net> - 2013-06-20 20:18 +0200
  Re: FORMS, validating mail was sent The Natural Philosopher <tnp@invalid.invalid> - 2013-06-20 19:24 +0100
    Re: FORMS, validating mail was sent Jerry Stuckle <jstucklex@attglobal.net> - 2013-06-20 14:40 -0400
    Re: FORMS, validating mail was sent gordonb.vb4vo@burditt.org (Gordon Burditt) - 2013-06-20 14:44 -0500
      Re: FORMS, validating mail was sent The Natural Philosopher <tnp@invalid.invalid> - 2013-06-20 22:03 +0100
      Re: FORMS, validating mail was sent Twayne <nobody@spamcop.net> - 2013-06-21 14:06 -0400
      Re: FORMS, validating mail was sent Twayne <nobody@spamcop.net> - 2013-06-22 11:42 -0400
      Re: FORMS, validating mail was sent Thomas 'PointedEars' Lahn <PointedEars@web.de> - 2013-06-23 13:13 +0200
        Re: FORMS, validating mail was sent The Natural Philosopher <tnp@invalid.invalid> - 2013-06-23 12:22 +0100
          Re: FORMS, validating mail was sent Twayne <nobody@spamcop.net> - 2013-06-23 13:07 -0400
        Re: FORMS, validating mail was sent Twayne <nobody@spamcop.net> - 2013-06-23 13:00 -0400
          Re: FORMS, validating mail was sent "J.O. Aho" <user@example.net> - 2013-06-23 20:22 +0200
            Re: FORMS, validating mail was sent Twayne <nobody@spamcop.net> - 2013-06-23 14:53 -0400
        Re: FORMS, validating mail was sent gordonb.4qaft@burditt.org (Gordon Burditt) - 2013-06-24 14:43 -0500
          Re: FORMS, validating mail was sent "Peter H. Coffin" <hellsop@ninehells.com> - 2013-06-24 15:09 -0500
          Re: FORMS, validating mail was sent Thomas 'PointedEars' Lahn <PointedEars@web.de> - 2013-06-25 15:19 +0200
            Re: FORMS, validating mail was sent Jerry Stuckle <jstucklex@attglobal.net> - 2013-06-25 10:11 -0400
              Re: FORMS, validating mail was sent Twayne <nobody@spamcop.net> - 2013-06-25 11:43 -0400
            Re: FORMS, validating mail was sent Twayne <nobody@spamcop.net> - 2013-06-25 11:32 -0400
            Re: FORMS, validating mail was sent gordonb.htsnc@burditt.org (Gordon Burditt) - 2013-06-27 10:57 -0500
              Re: FORMS, validating mail was sent Thomas 'PointedEars' Lahn <PointedEars@web.de> - 2013-06-27 21:13 +0200
            Re: FORMS, validating mail was sent Arno Welzel <usenet@arnowelzel.de> - 2013-06-28 11:43 +0200
  Re: FORMS, validating mail was sent gordonb.k0cb7@burditt.org (Gordon Burditt) - 2013-06-20 15:46 -0500
    Re: FORMS, validating mail was sent Jerry Stuckle <jstucklex@attglobal.net> - 2013-06-20 17:03 -0400
      Re: FORMS, validating mail was sent gordonb.udxst@burditt.org (Gordon Burditt) - 2013-06-21 19:26 -0500
        Re: FORMS, validating mail was sent Jerry Stuckle <jstucklex@attglobal.net> - 2013-06-21 20:36 -0400
      Re: FORMS, validating mail was sent Twayne <nobody@spamcop.net> - 2013-06-22 12:04 -0400
    Re: FORMS, validating mail was sent Christoph Michael Becker <cmbecker69@arcor.de> - 2013-06-20 23:39 +0200
      Re: FORMS, validating mail was sent Tim Streater <timstreater@greenbee.net> - 2013-06-21 10:11 +0100
        Re: FORMS, validating mail was sent The Natural Philosopher <tnp@invalid.invalid> - 2013-06-21 11:25 +0100
          Re: FORMS, validating mail was sent Tim Streater <timstreater@greenbee.net> - 2013-06-21 12:27 +0100
            Re: FORMS, validating mail was sent The Natural Philosopher <tnp@invalid.invalid> - 2013-06-21 17:59 +0100
              Re: FORMS, validating mail was sent Tim Streater <timstreater@greenbee.net> - 2013-06-21 18:25 +0100
                Re: FORMS, validating mail was sent The Natural Philosopher <tnp@invalid.invalid> - 2013-06-21 23:43 +0100
                Re: FORMS, validating mail was sent Tim Streater <timstreater@greenbee.net> - 2013-06-22 13:45 +0100
          Re: FORMS, validating mail was sent Twayne <nobody@spamcop.net> - 2013-06-22 12:20 -0400
    Re: FORMS, validating mail was sent "Peter H. Coffin" <hellsop@ninehells.com> - 2013-06-20 17:27 -0500
      Re: FORMS, validating mail was sent The Natural Philosopher <tnp@invalid.invalid> - 2013-06-21 07:57 +0100
    Re: FORMS, validating mail was sent Twayne <nobody@spamcop.net> - 2013-06-22 12:02 -0400
  Re: FORMS, validating mail was sent GravyCode <matty023@gmail.com> - 2013-06-21 11:30 -0700

csiph-web