Someone please help me!

[davidannis]

Which won't help secure your form, a script doesn't have cookies/sessions, so you are only blocking any users that may want to send you a second e-mail. A bot will still simply send out a million mails.

I wasn't suggesting that would secure his script against a bot sending a million e-mails to him, only explaining why he got the error message. However, a bot does not need his script to send him 1,000,000 emails, it can just attach to his port 25 and SPAM away. The big problem would be if his script allowed the bot to send to any e-mail address. Since his address is hard coded I don't think it is likely to be a problem.

[ignace]

I was actually replying to the OP about jcbones' code using your comment, it wasn't directly pointed at you. But yeah sure they can fire up any script and send a million mails IF they know his e-mail. However the form provides an open gateway for any attacker to e-mail him WITHOUT knowing his e-mail address.

 

Also I need to test what the below code would do:

 

$from = filter_var(filter_var('foo%40bar.com%0ATo%[email protected]', FILTER_SANITIZE_EMAIL), FILTER_VALIDATE_EMAIL);
echo $from;
echo 'mail sent ' . (mail('[email protected]', 'Test', 'test', 'From: ' . $from . "\n") ? 'success' : 'failed');