tryingtolearn Posted January 1, 2010 Share Posted January 1, 2010 Im trying to figure out if my bases are covered Here is the scenario: There is an html form on 1 site that points to a processing form on another site. It has name, and email text fields and a comments text box passed via POST. The processing form takes each of the variables passed to it like this trim(strip_tags(stripslashes($_POST['var']))) the mail script has the to address hardcoded into it. Is it still vunerable to header injection? I guess Im trying to grasp how the info is going to get from the form to the header in this manner. Thanks for any input. Quote Link to comment https://forums.phpfreaks.com/topic/186853-getting-a-handle-on-mail-security/ Share on other sites More sharing options...
cags Posted January 1, 2010 Share Posted January 1, 2010 Depends on the server settings on the site. If the values have been escaped due to magic_quotes settings, the stripslashes would only strip the escape slashes leaving any \r\n characters in place still. It also very much depends what the script does with the values. Personally I'd recommend htmlentities over strip_tags as it leaves the content in tact. Quote Link to comment https://forums.phpfreaks.com/topic/186853-getting-a-handle-on-mail-security/#findComment-986781 Share on other sites More sharing options...
tryingtolearn Posted January 1, 2010 Author Share Posted January 1, 2010 Thanks for the response, Im just passing the variables in the body of the email to get the info. htmlentities - OK I was just thinking to get rid of it alltogether but... So would it be better to remove instances of \r \n? Quote Link to comment https://forums.phpfreaks.com/topic/186853-getting-a-handle-on-mail-security/#findComment-986788 Share on other sites More sharing options...
cags Posted January 1, 2010 Share Posted January 1, 2010 As I said it depends on what exactly your doing with the variables and also on the server settings. If for example your talking about the main 'body' of the message (ie the $message/3rd parameter) you don't want to remove \r\n characters because that would prevent the user from actually applying any newline characters in the message they are sending which could lead to a right mess. But obviously this depends what type of mail it's sending, if all your form does is send details about a person via e-mail then you perhaps don't want need that as you will have a predefined layout. If however it is a feedback form, allowing long messages without newline characters would make it very hard to read. If the variable is being put into a header though such as.. $headers .= "From: $var\r\n"; // or $headers .= "Reply-To: $var\r\n"; Then it's important that $var doesn't contain \r\n characters since this would allow somebody to submit "bob@tbuilder\r\nCC:[email protected],[email protected]" etc. Quote Link to comment https://forums.phpfreaks.com/topic/186853-getting-a-handle-on-mail-security/#findComment-986799 Share on other sites More sharing options...
tryingtolearn Posted January 1, 2010 Author Share Posted January 1, 2010 I guess thats the skinny of my question. So if you have a set up like this ... if (preg_match('/^[[:alnum:]][a-z0-9_\.\-]*@[a-z0-9\.\-]+\.[a-z]{2,4}$/i', trim(htmlentities(stripslashes($_POST['email']))))) { $e = strip_tags($_POST['email']); } else { $e = FALSE; echo '<p class="error">Please enter a valid email address!</p>'; } ... $message = "NAME-$fn $ln \r\n"; $message .= "EMAIL - $e \r\n"; $message .= "STATE/ZIPCODE - $st $zc \r\n"; $message .= "DESCRIPTION - $sanscript"; mail('[email protected], 'mySubject', $message) is it vulnerable through the $ message var? Sorry if Im seeming a bit dense on this but I guess Im not seeing how this is a vulnerability but I have been told that it is. Quote Link to comment https://forums.phpfreaks.com/topic/186853-getting-a-handle-on-mail-security/#findComment-986805 Share on other sites More sharing options...
cags Posted January 1, 2010 Share Posted January 1, 2010 Providing the values are being inserted into $message and you have some form of protection against XSS (strip_tags, htmlentities etc.) I don't see in what way it is vulnerable. I could be wrong, but I don't see anything that can be exploited. Quote Link to comment https://forums.phpfreaks.com/topic/186853-getting-a-handle-on-mail-security/#findComment-986809 Share on other sites More sharing options...
tryingtolearn Posted January 1, 2010 Author Share Posted January 1, 2010 Cags, I appreciate you taking the time on this thread. Its a broad topic and when I hear something I start to question things so I just wanted to be sure what I was thinking made sense. Thanks for the time and input. Quote Link to comment https://forums.phpfreaks.com/topic/186853-getting-a-handle-on-mail-security/#findComment-986811 Share on other sites More sharing options...
Daniel0 Posted January 1, 2010 Share Posted January 1, 2010 HTML emails suck anyway. I hate when people send me that. Quote Link to comment https://forums.phpfreaks.com/topic/186853-getting-a-handle-on-mail-security/#findComment-986814 Share on other sites More sharing options...
cags Posted January 1, 2010 Share Posted January 1, 2010 HTML emails suck anyway. I hate when people send me that. Technically speaking I don't think the OP actually specified it was a HTML e-mail. I have to say I disagree though, having clickable links in emails (at least ones you want to receive) can be useful. Quote Link to comment https://forums.phpfreaks.com/topic/186853-getting-a-handle-on-mail-security/#findComment-986822 Share on other sites More sharing options...
tryingtolearn Posted January 1, 2010 Author Share Posted January 1, 2010 This particular one isnt html But there are plenty of applications that I do use them. No better way to boost sales than a few product pictures w/ links right to the item to buy it. Never underestimate the impulse shoppers Quote Link to comment https://forums.phpfreaks.com/topic/186853-getting-a-handle-on-mail-security/#findComment-986826 Share on other sites More sharing options...
Daniel0 Posted January 1, 2010 Share Posted January 1, 2010 HTML emails suck anyway. I hate when people send me that. Technically speaking I don't think the OP actually specified it was a HTML e-mail. I have to say I disagree though, having clickable links in emails (at least ones you want to receive) can be useful. That's why you would use a proper email client that makes links clickable. Kind of like I don't have to put URL tags around this: http://www.phpfreaks.com You'll also find that many mailing lists' guidelines prohibit HTML email as well. All of PHP's mailing lists do for instance. Quote Link to comment https://forums.phpfreaks.com/topic/186853-getting-a-handle-on-mail-security/#findComment-986829 Share on other sites More sharing options...
tryingtolearn Posted January 1, 2010 Author Share Posted January 1, 2010 All of PHP's mailing lists do for instanceWhat do you mean by ALL PHP's?? Quote Link to comment https://forums.phpfreaks.com/topic/186853-getting-a-handle-on-mail-security/#findComment-986853 Share on other sites More sharing options...
Daniel0 Posted January 1, 2010 Share Posted January 1, 2010 All of PHP's mailing lists do for instanceWhat do you mean by ALL PHP's?? http://dictionary.reference.com/browse/all http://www.php.net/mailing-lists.php Quote Link to comment https://forums.phpfreaks.com/topic/186853-getting-a-handle-on-mail-security/#findComment-986855 Share on other sites More sharing options...
tryingtolearn Posted January 1, 2010 Author Share Posted January 1, 2010 Oh I get you now http://dictionary.reference.com/browse/jokes Quote Link to comment https://forums.phpfreaks.com/topic/186853-getting-a-handle-on-mail-security/#findComment-986873 Share on other sites More sharing options...
Recommended Posts
Join the conversation
You can post now and register later. If you have an account, sign in now to post with your account.