davidannis Posted April 17, 2013 Share Posted April 17, 2013 Which won't help secure your form, a script doesn't have cookies/sessions, so you are only blocking any users that may want to send you a second e-mail. A bot will still simply send out a million mails. I wasn't suggesting that would secure his script against a bot sending a million e-mails to him, only explaining why he got the error message. However, a bot does not need his script to send him 1,000,000 emails, it can just attach to his port 25 and SPAM away. The big problem would be if his script allowed the bot to send to any e-mail address. Since his address is hard coded I don't think it is likely to be a problem. Quote Link to comment Share on other sites More sharing options...
ignace Posted April 17, 2013 Share Posted April 17, 2013 (edited) I was actually replying to the OP about jcbones' code using your comment, it wasn't directly pointed at you. But yeah sure they can fire up any script and send a million mails IF they know his e-mail. However the form provides an open gateway for any attacker to e-mail him WITHOUT knowing his e-mail address. Also I need to test what the below code would do: $from = filter_var(filter_var('foo%40bar.com%0ATo%3Ae1634719@rmqkr.net', FILTER_SANITIZE_EMAIL), FILTER_VALIDATE_EMAIL); echo $from; echo 'mail sent ' . (mail('t@t.t', 'Test', 'test', 'From: ' . $from . "\n") ? 'success' : 'failed'); Edited April 17, 2013 by ignace Quote Link to comment Share on other sites More sharing options...
Recommended Posts
Join the conversation
You can post now and register later. If you have an account, sign in now to post with your account.