PHP secure emails

In the PHP e-mail script in the previous section, there is a vulnerability

Introduction to constants

##·

FILTER_SANITIZE_EMAIL Filter removes illegal characters of email from a string

FILTER_VALIDATE_EMAIL Filter validates the value of an email address

PHP E-mail Injection

First of all, please look at the PHP code in the previous chapter:

<html>
 <head>
 <meta charset="utf-8">
 <title>php中文网(php.cn)</title>
 </head>
 <body>
 
 <?php
 if (isset($_REQUEST['email'])) { // 如果接收到邮箱参数则发送邮件
     // 发送邮件
     $email = $_REQUEST['email'] ;
     $subject = $_REQUEST['subject'] ;
     $message = $_REQUEST['message'] ;
     mail("someone@example.com", $subject,
         $message, "From:" . $email);
     echo "邮件发送成功";
 } else { // 如果没有邮箱参数则显示表单
     echo "<form method='post' action=''>
    Email: <input name='email' type='text'><br>
    Subject: <input name='subject' type='text'><br>
    Message:<br>
    <textarea name='message' rows='15' cols='40'>
    </textarea><br>
    <input type='submit'>
    </form>";
 }
 ?>
 
 </body>
 </html>

Problems with the above code Yes, unauthorized users can insert data into email headers via the input form.

What will happen if the user adds the following text to the email in the input box in the form?

someone@example.com%0ACc:person2@example.com%0ABcc:person3@example.com,person3@example.com,
anotherperson4@example. com,person5@example.com
%0ABTo:person6@example.com

##As always, mail () function puts the above text into the email header, so now the header has additional Cc:, Bcc: and To: fields. When the user clicks the submit button, this e-mail will be sent to all the addresses

above!

##PHP prevents email injection

#The best way to prevent e-mail injection is to validate the input. The following code is similar to the one in the previous chapter, but here we have added an input validation program to detect the email field in the form:

<html>
<head>
    <meta charset="utf-8">
    <title>php中文网(php.cn)</title>
</head>
<body>
<?php
function spamcheck($field)
{
    // filter_var() 过滤 e-mail
    // 使用 FILTER_SANITIZE_EMAIL
    $field=filter_var($field, FILTER_SANITIZE_EMAIL);
    //filter_var() 过滤 e-mail
    // 使用 FILTER_VALIDATE_EMAIL
    if(filter_var($field, FILTER_VALIDATE_EMAIL))
    {
        return TRUE;
    }
    else
    {
        return FALSE;
    }
}
if (isset($_REQUEST['email']))
{
    // 如果接收到邮箱参数则发送邮件
    // 判断邮箱是否合法
    $mailcheck = spamcheck($_REQUEST['email']);
    if ($mailcheck==FALSE)
    {
        echo "非法输入";
    }
    else
    {
        // 发送邮件
        $email = $_REQUEST['email'] ;
        $subject = $_REQUEST['subject'] ;
        $message = $_REQUEST['message'] ;
        mail("someone@example.com", "Subject: $subject",
            $message, "From: $email" );
        echo "Thank you for using our mail form";
    }
}
else
{
    // 如果没有邮箱参数则显示表单
    echo "<form method='post' action=''>
   Email: <input name='email' type='text'><br>
   Subject: <input name='subject' type='text'><br>
   Message:<br>
   <textarea name='message' rows='15' cols='40'>
   </textarea><br>
   <input type='submit'>
   </form>";
}
?>
</body>
</html>

In the above code, we used a PHP filter to validate the input: ·

FILTER_SANITIZE_EMAIL

Filter removes illegal characters of email from the string

· FILTER_VALIDATE_EMAIL Filter validates the value of the email address

You can read more about filters in our PHP Filter.

Continuing Learning

new file

<html> <head> <meta charset="utf-8"> <title>php中文网(php.cn)</title> </head> <body> <?php function spamcheck($field) { // filter_var() 过滤 e-mail // 使用 FILTER_SANITIZE_EMAIL $field=filter_var($field, FILTER_SANITIZE_EMAIL); //filter_var() 过滤 e-mail // 使用 FILTER_VALIDATE_EMAIL if(filter_var($field, FILTER_VALIDATE_EMAIL)) { return TRUE; } else { return FALSE; } } if (isset($_REQUEST['email'])) { // 如果接收到邮箱参数则发送邮件 // 判断邮箱是否合法 $mailcheck = spamcheck($_REQUEST['email']); if ($mailcheck==FALSE) { echo "非法输入"; } else { // 发送邮件 $email = $_REQUEST['email'] ; $subject = $_REQUEST['subject'] ; $message = $_REQUEST['message'] ; mail("someone@example.com", "Subject: $subject", $message, "From: $email" ); echo "Thank you for using our mail form"; } } else { // 如果没有邮箱参数则显示表单 echo "<form method='post' action=''> Email: <input name='email' type='text'><br> Subject: <input name='subject' type='text'><br> Message:<br> <textarea name='message' rows='15' cols='40'> </textarea><br> <input type='submit'> </form>"; } ?> </body> </html>

submit Reset Code

Automatic operation

PHP secure emails

ElementaryImperial CMS enterprise imitation website tutorial

ElementaryNewbies with zero foundation in WordPress build personal blogs and corporate websites

ElementaryUltimate CMS zero-based website building instruction video

ElementaryFront-end project-Shangyou [HTML/CSS/JS technology comprehensive practice]

IntermediateVue3.0 from 0 to build a universal backend management system project practice

ElementaryZero-based front-end course [Vue advanced learning and practical application]

ElementaryWEB front-end tutorial [HTML5+CSS3+JS]

ElementaryQuick introduction to apipost

IntermediateVue3+TypeScript practical tutorial-enterprise-level project practice

ElementaryLet's briefly talk about starting a business in PHP

IntermediateVUE e-commerce project (front-end & back-end dual project actual combat)

ElementaryApipost practical application [api, interface, automated testing, mock]