PHP secure email-PHP Tutorial-php.cn

PHP secure email

巴扎黑

Release： 2016-11-11 18:03:48

Original

1507 people have browsed it

PHP Secure Email

PHP E-mail

PHP Error

In the PHP e-mail script in the previous section, there is a vulnerability.

PHP E-mail Injection

First, look at the PHP code in the previous section:

<html>
<body>
<?php
if (isset($_REQUEST[&#39;email&#39;]))
//if "email" is filled out, send email
  {
  //send email
  $email = $_REQUEST[&#39;email&#39;] ; 
  $subject = $_REQUEST[&#39;subject&#39;] ;
  $message = $_REQUEST[&#39;message&#39;] ;
  mail("someone@example.com", "Subject: $subject",
  $message, "From: $email" );
  echo "Thank you for using our mail form";
  }
else
//if "email" is not filled out, display the form
  {
  echo "<form method=&#39;post&#39; action=&#39;mailform.php&#39;>
  Email: <input name=&#39;email&#39; type=&#39;text&#39; /><br />
  Subject: <input name=&#39;subject&#39; type=&#39;text&#39; /><br />
  Message:<br />
  <textarea name=&#39;message&#39; rows=&#39;15&#39; cols=&#39;40&#39;>
  </textarea><br />
  <input type=&#39;submit&#39; />
  </form>";
  }
?>
</body>
</html>

Copy after login

The problem with the above code is that unauthorized users can insert data in the email header through the input form.

What will happen if the user adds these texts to the input box in the form?

someone@example.com%0ACc:person2@example.com

%0ABcc:person3@example.com,person3@example.com,

anotherperson4@example.com,person5@example.com

%0ABTo: person6@example.com

As usual, the mail() function puts the above text into the email header, so now the header has additional Cc:, Bcc: and To: fields. When the user clicks the submit button, this e-mail will be sent to all the addresses above!

PHP Prevent E-mail Injection

The best way to prevent e-mail injection is to validate the input.

The following code is similar to the previous section, but we have added an input validator to detect the email field in the form:

<html>
<body>
<?php
function spamcheck($field)
  {
  //filter_var() sanitizes the e-mail 
  //address using FILTER_SANITIZE_EMAIL
  $field=filter_var($field, FILTER_SANITIZE_EMAIL);
  
  //filter_var() validates the e-mail
  //address using FILTER_VALIDATE_EMAIL
  if(filter_var($field, FILTER_VALIDATE_EMAIL))
    {
    return TRUE;
    }
  else
    {
    return FALSE;
    }
  }
if (isset($_REQUEST[&#39;email&#39;]))
  {//if "email" is filled out, proceed
  //check if the email address is invalid
  $mailcheck = spamcheck($_REQUEST[&#39;email&#39;]);
  if ($mailcheck==FALSE)
    {
    echo "Invalid input";
    }
  else
    {//send email
    $email = $_REQUEST[&#39;email&#39;] ; 
    $subject = $_REQUEST[&#39;subject&#39;] ;
    $message = $_REQUEST[&#39;message&#39;] ;
    mail("someone@example.com", "Subject: $subject",
    $message, "From: $email" );
    echo "Thank you for using our mail form";
    }
  }
else
  {//if "email" is not filled out, display the form
  echo "<form method=&#39;post&#39; action=&#39;mailform.php&#39;>
  Email: <input name=&#39;email&#39; type=&#39;text&#39; /><br />
  Subject: <input name=&#39;subject&#39; type=&#39;text&#39; /><br />
  Message:<br />
  <textarea name=&#39;message&#39; rows=&#39;15&#39; cols=&#39;40&#39;>
  </textarea><br />
  <input type=&#39;submit&#39; />
  </form>";
  }
?>
</body>
</html>

Copy after login

In the above code, we use a PHP filter to validate the input:

FILTER_SANITIZE_EMAIL Remove illegal characters of email from string

FILTER_VALIDATE_EMAIL Verify email address