WeberDev.com PHP and MySQL Code

LOG IN
BEGINNER GUIDES  |  PHP CLASSES  |  CODE SEARCH  |  ARTICLES SEARCH  |  PHP FORUMS  |  PHP MANUAL  |  PHP FUNCTIONS LIST  |  WEB SITE TEMPLATES
Start typing to search for PHP and MySQL Code Snippets and Articles Search
Submit a code Example / Snippet Submit Your Code
Search Engine Optimization Monitor SEO Monitor
Web Site UpTime Monitor UpTime Monitor
WeberDev's Monthly code contest PHP Code Contest
Your Personal Examples List My Favorite Examples
Your Personal Articles List My Favorite Articles
Edit Account Info Update Your Profile
PHP Code Search
Web Development Forums
Learn MySQL Playing Trivia
PHPBB2 Templates
Web Development Index
Web Development Resources
Web Development Content
PHPClasses
PHP Editor
PHP Jobs
Vision.To Design
Ajax Tutorials
PHP Programming Help
PHP/MySQL Programming
Webmaster Resources
Webmaster Forum
XML meta language
website builder
Forex Trading Online forex trading platform

Go Back Add a Comment Send this example to a friend Add this Article to your personal favoritest for easy future access to your favorite Code Examples and Articles. Submit a code example Print this code example.
BACK ADD A COMMENT SEND TO A FRIEND ADD TO MY FAVORITES ADD CODE EXAMPLES PRINT
Title : send_mail function to defeat Header Injection Hacking/Spamming
Categories : PHP, Email, Form Processing, Security Click here to Update Your Picture
Jon Slack
Date : Oct 17th 2005
Grade : 1 of 5 (graded 3 times)
Viewed : 9093
File : No file for this code example.
Images : No Images for this code example.
Search : More code by Jon Slack
Action : Grade This Code Example
Tools : My Examples List

  Submit your own code examples 
 

<?
// Written by my working partner, Marc Jones (edm-i.com) who
// says this function should augment the php mail() function

// hacker/spammer safe wrapper for php mail() function that will allow plain text and mixed html email
// version 1 does not handle attachments - I'll work on that

function send_email($to, $fromaddr, $fromname, $subject, $message_text, $message_html = "")
{
 
// to prevent spammers/hackers from utilising your html2server email form
  // this type of hacking is called "header injection" where the spammer will call your
  // script with the subject or message containing more header information before the message
  // allowing them to send as many mails as they like, and blacklisting your mail server as a spammer
  // they mostly change the headers, and add cc, and bcc headers.
  // The best way to stop this is to check for headers and remove them!
 
$subject = preg_replace("/\nfrom\:.*?\n/i", "", $subject);
 
$subject = preg_replace("/\nbcc\:.*?\n/i", "", $subject);
 
$subject = preg_replace("/\ncc\:.*?\n/i", "", $subject);
 
$message_text = preg_replace("/\nfrom\:.*?\n/i", "", $message_text);
 
$message_text = preg_replace("/\nbcc\:.*?\n/i", "", $message_text);
 
$message_text = preg_replace("/\ncc\:.*?\n/i", "", $message_text);
 
$message_html = preg_replace("/\nfrom\:.*?\n/i", "", $message_html);
 
$message_html = preg_replace("/\nbcc\:.*?\n/i", "", $message_html);
 
$message_html = preg_replace("/\ncc\:.*?\n/i", "", $message_html);

 
// create additional_parameters - this ensures that the RETURN-PATH will be properly set
  // saving the mail from being rejected by the destination mail server as spam
  // known servers that reject if RETURN-PATH domain does not match the from domain include
  // gmail, hotmail, aol, excite, yahoo, btinternet
  // most spam killers will also regard emails with
 
$additional_parameters = "-f $fromaddr";

 
// create additional_headers
 
$headers = "From: $fromname <$fromaddr>\r\n";

 
// specify MIME version 1.0
 
$headers .= "MIME-Version: 1.0\r\n";

 
// deal with html messages
 
if($message_html != "")
  {
   
// unique boundary
   
$boundary = uniqid("sometext");

   
// tell e-mail client this e-mail contains alternate versions
   
$headers .= "Content-Type: multipart/alternative; boundary = $boundary\r\n\r\n";

   
// plain text version of message
   
$body  = "--$boundary\r\n";
   
$body .= "Content-Type: text/plain; charset=ISO-8859-1\r\n";
   
$body .= "Content-Transfer-Encoding: 7 bit\r\n\r\n";
   
$body .= $message_text."\r\n\r\n";

   
// HTML version of message
   
$body .= "--$boundary\r\n";
   
$body .= "Content-Type: text/html; charset=ISO-8859-1\r\n";
   
$body .= "Content-Transfer-Encoding: t bit\r\n\r\n";
   
$body .= $message_html."\r\n\r\n";
  }

 
// deal with plain text only messages
 
if($message_html == "")
  {
   
// tell e-mail client the content type
     
$headers .= "Content-type: text/plain; charset=iso-8859-1\n";

   
// the plain text message
   
$body = $message_text;
  }

 
// send message
 
return mail($to, $subject, $body, $headers, $additional_parameters);
}

?>
send php mail with form data and attachment.
Categories : PHP, Email, Mail, Form Processing
Protect your mailto: email addresses from bots - pure PHP
Categories : PHP, Email, Security
addslashes automatically to $_POST variables
Categories : PHP, Form Processing, Security



cPanel Email Accounts Creator
Categories : PHP, PHP Classes, Email, Form Processing, Web Services
Customer feedback or simple emailer - A PHP script that enables your visitors to send you emails.
Categories : PHP, Email, Form Processing
Encoding data using PGP via PHP's proc_* functions
Categories : Cryptography, Security, Email, PHP, PGP
Creates a CAPTCHA image in PHP, which displays 5 numbers stored in a session.
Categories : PHP, GD image library, Form Processing, Security
A damaged image generator (class) for validating text. CAPTCHA - Completely Automated Public Turing test to tell Computers and Humans Apart
Categories : PHP, PHP Classes, Security, GD image library, Security
PHP Cookies - Simple cookie write/read methods that allow basic encryption
Categories : PHP, Cookies, Security, Encryption
A login page that require username, password and userlevel.
Categories : PHP, Security, Sessions, MySQL, Databases
Sending email with random details
Categories : PHP, Email, Debugging
Use of bitmasks to represent permissions
Categories : PHP, Authentication, Bitwise Operators, Security, PHP Classes
phpSecurePages is a PHP module to secures pages with a loginname and password. It handles multiple user groups (each has own viewing rights), store data in a MySQL database or a configuration file, and can be used to identify Web site viewers.
Categories : PHP, Security, Authentication
Using this script anyone can easily get a form result to his/her mailbox. You can use this script for any form 2 mail purpose.
Categories : PHP, Mail, Form Processing
 Roland Booth wrote :1361
Thanks for this. Arrive just when i needed it