getting a handle on mail() security

[tryingtolearn]

Im trying to figure out if my bases are covered

Here is the scenario:

There is an html form on 1 site that points to a processing form on another site.

It has  name, and email text fields and a comments text box passed via POST.

 

The processing form

takes each of the variables passed to it like this

trim(strip_tags(stripslashes($_POST['var'])))

 

the mail script has the to address hardcoded into it.

 

Is it still vunerable to header injection?

I guess Im trying to grasp how the info is going to get from the form to the header in this manner.

Thanks for any input.

 

 

 

 

[cags]

Depends on the server settings on the site. If the values have been escaped due to magic_quotes settings, the stripslashes would only strip the escape slashes leaving any \r\n characters in place still. It also very much depends what the script does with the values. Personally I'd recommend htmlentities over strip_tags as it leaves the content in tact.

[tryingtolearn]

Thanks for the response,

Im just passing the variables in the body of the email to get the info.

 

htmlentities - OK I was just thinking to get rid of it alltogether but...

 

So would it be better to remove instances of \r \n?

[cags]

As I said it depends on what exactly your doing with the variables and also on the server settings. If for example your talking about the main 'body' of the message (ie the $message/3rd parameter) you don't want to remove \r\n characters because that would prevent the user from actually applying any newline characters in the message they are sending which could lead to a right mess. But obviously this depends what type of mail it's sending, if all your form does is send details about a person via e-mail then you perhaps don't want need that as you will have a predefined layout. If however it is a feedback form, allowing long messages without newline characters would make it very hard to read.

 

If the variable is being put into a header though such as..

 

$headers .= "From: $var\r\n";
// or
$headers .= "Reply-To: $var\r\n";

Then it's important that $var doesn't contain \r\n characters since this would allow somebody to submit "bob@tbuilder\r\nCC:a@domain.com,b@domain.com" etc.

 

[tryingtolearn]

I guess thats the skinny of my question.

 

So if you have a set up like this

...


if (preg_match('/^[[:alnum:]][a-z0-9_\.\-]*@[a-z0-9\.\-]+\.[a-z]{2,4}$/i', trim(htmlentities(stripslashes($_POST['email']))))) {
	$e = strip_tags($_POST['email']);
	} else {
	$e = FALSE;
	echo '<p class="error">Please enter a valid email address!</p>';
	}


...
$message = "NAME-$fn $ln \r\n";
$message .= "EMAIL - $e \r\n";
$message .= "STATE/ZIPCODE - $st $zc \r\n";
$message .= "DESCRIPTION - $sanscript";	

mail('myeMail@comcast.net, 'mySubject', $message)

 

is it vulnerable through the $ message var?

 

Sorry if Im seeming a bit dense on this but I guess Im not seeing how this is a vulnerability but I have been told that it is.

[cags]

Providing the values are being inserted into $message and you have some form of protection against XSS (strip_tags, htmlentities etc.) I don't see in what way it is vulnerable. I could be wrong, but I don't see anything that can be exploited.

[tryingtolearn]

Cags, I appreciate you taking the time on this thread.

Its a broad topic and when I hear something I start to question things so I just wanted to be sure what I was thinking made sense.

 

Thanks for the time and input.

[Daniel0]

HTML emails suck anyway. I hate when people send me that.

[cags]

HTML emails suck anyway. I hate when people send me that.

Technically speaking I don't think the OP actually specified it was a HTML e-mail. I have to say I disagree though, having clickable links in emails (at least ones you want to receive) can be useful.

[tryingtolearn]

This particular one isnt html

But there are plenty of applications that I do use them.

 

No better way to boost sales than a few product pictures w/ links right to the item to buy it.

Never underestimate the impulse shoppers 

[Daniel0]

HTML emails suck anyway. I hate when people send me that.

Technically speaking I don't think the OP actually specified it was a HTML e-mail. I have to say I disagree though, having clickable links in emails (at least ones you want to receive) can be useful.

 

That's why you would use a proper email client that makes links clickable. Kind of like I don't have to put URL tags around this: http://www.phpfreaks.com

 

You'll also find that many mailing lists' guidelines prohibit HTML email as well. All of PHP's mailing lists do for instance.

[tryingtolearn]

All of PHP's mailing lists do for instance

What do you mean by ALL PHP's??

[Daniel0]

All of PHP's mailing lists do for instance

What do you mean by ALL PHP's??

 

http://dictionary.reference.com/browse/all

http://www.php.net/mailing-lists.php

[tryingtolearn]

Oh I get you now

http://dictionary.reference.com/browse/jokes