Jump to content

Search the Community

Showing results for tags 'header injection'.

  • Search By Tags

    Type tags separated by commas.
  • Search By Author

Content Type


  • Welcome to PHP Freaks
    • Announcements
    • Introductions
  • PHP Coding
    • PHP Coding Help
    • Regex Help
    • Third Party Scripts
    • FAQ/Code Snippet Repository
  • SQL / Database
    • MySQL Help
    • PostgreSQL
    • Microsoft SQL - MSSQL
    • Other RDBMS and SQL dialects
  • Client Side
    • HTML Help
    • CSS Help
    • Javascript Help
    • Other
  • Applications and Frameworks
    • Applications
    • Frameworks
    • Other Libraries
  • Web Server Administration
    • PHP Installation and Configuration
    • Linux
    • Apache HTTP Server
    • Microsoft IIS
    • Other Web Server Software
  • Other
    • Application Design
    • Other Programming Languages
    • Editor Help (PhpStorm, VS Code, etc)
    • Website Critique
    • Beta Test Your Stuff!
  • Freelance, Contracts, Employment, etc.
    • Services Offered
    • Job Offerings
  • General Discussion
    • PHPFreaks.com Website Feedback
    • Miscellaneous

Find results in...

Find results that contain...

Date Created

  • Start


Last Updated

  • Start


Filter by number of...


  • Start





Website URL








Donation Link

Found 1 result

  1. I created a script that takes info in the url (script.php?id=123), compares that number (123) to a database and gets more information about that person (name, etc.). The number also corresponds to their email address (123@domain.com). The information is passed to an email script which is a contact form. The contact form only sends the email to 123@domain.com and cannot be changed by the user. The user can enter their name, email, a subject, and the message. The name and subject are converted into email headers and sent to 123@domain.com (from: the user submiited info). My question is that although the user cannot change the to: address, can they still input code into the name, email, and subject fields to inject additional to: addresses? If so, any suggestions on exsting code that could elimiate this threat? Thanks!
  • Create New...

Important Information

We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.