How to Prevent Email Injection in Your PHP Mail Form Scripts

Code your PHP scripts to prevent this security vulnerability


How to Prevent Email Injection in Your PHP Form to Mail Scripts

by Christopher Heng, thesitewizard.com

Nowadays, many websites no longer post their webmasters' email addresses, preferring instead to put up a contact or feedback form. Without the plethora of email addresses to harvest from websites, spammers have turned to using such feedback form scripts to send spam instead. If you are writing your own feedback form script, it is important that you write your script in such a way so as to prevent spammers from hijacking the script to spam others.

How Does Email Form Hijacking Work?

A PHP script that sends email, as mentioned in my PHP tutorial, typically calls on the mail() function to deliver the email. For example, the code for such a script might look like the following.

mail( "yourname@example.com", "Feedback Form Results", $message, "From: $email" );

The code above sends the message to yourname@example.com, which is presumably the webmaster's address. The sender's address is set to the information contained in the $email variable, which is typically obtained from the web form.

If the script takes no effort to sanitize the $email variable before calling mail(), it is possible for a spammer to inject additional headers into the email messages by placing lines like the following into the $email variable.

some-email-address@example.com
CC: another-email-address@example.com, yet-another-email-addresses@example.com, etc-etc@example.com

The PHP mail() function will dumbly insert those lines into the header of the email message, and pass it along to the mail transport agent, which in turns delivers the mail to everyone on that list. In this way, your script will have been hijacked to do the spammer's bidding.

How to Avoid Email Injection and Mail Form Script Hijacking

To prevent email injection of the form given above, it is important that you check the information you receive from the $email variable.

There are many ways you can look out for attempts to insert email headers into your scripts. The PHP script generated by thesitewizard.com's Feedback Form Script Wizard does it this way:

if ( preg_match( "/[\r\n]/", $name ) || preg_match( "/[\r\n]/", $email ) ) {

  [... direct user to an error page and quit ...]
  [... see http://www.thesitewizard.com/archive/feedbackphp.shtml ...]
  [... if you don't know how to do this ...]

}

$name contains the visitor's name, and $email holds the visitor's email address. A function called preg_match() is called to find out if the contents of those two variables include the new line characters. New line characters, like the carriage return ("\r" in PHP) and line feed ("\n" in PHP), create a new line in the email headers, which allows the formation of a new "cc:" line. If the code above detects that there are new line characters, the user is directed to an error page.

Conclusion

Avoid this security hole in your PHP scripts that send mail by making sure that everything that goes into the email headers generated by your script is checked for potentially problematic characters like the above. Otherwise, your script might be inadvertantly abused to send spam to others without your knowing.

Copyright © 2007-2014 by Christopher Heng. All rights reserved.
Get more free tips and articles like this, on web design, promotion, revenue and scripting, from http://www.thesitewizard.com/.

thesitewizard™ News Feed (RSS Site Feed)  Subscribe to thesitewizard.com newsfeed

Do you find this article useful? You can learn of new articles and scripts that are published on thesitewizard.com by subscribing to the RSS feed. Simply point your RSS feed reader or a browser that supports RSS feeds at http://www.thesitewizard.com/thesitewizard.xml. You can read more about how to subscribe to RSS site feeds from my RSS FAQ.

Please Do Not Reprint This Article

This article is copyrighted. Please do not reproduce this article in whole or part, in any form, without obtaining my written permission.

Related Pages

New Articles

Popular Articles

How to Link to This Page

It will appear on your page as:

How to Prevent Email Injection in Your PHP Form-to-Mail Scripts





Home
Donate
Contact Us
Link to Us
Topics
Site Map

Getting Started
Web Design
Search Engines
Revenue Making
Domains
Web Hosting
Blogging
JavaScripts
PHP
Perl / CGI
HTML
CSS
.htaccess / Apache
Newsletters
General
Seasonal
Reviews
FAQs
Wizards

 

 
Free webmasters and programmers resources, scripts and tutorials
 
HowtoHaven.com: Free How-To Guides
 
Site Design Tips at thesitewizard.com
Find this site useful?
Please link to us.