What is the best way to prevent email Injection in a mailform?

Question

Hello I have build a email form and I like to know if it is build in a secure way.
I have read the article How to Prevent Email Injection in Your PHP Form to Mail Scripts and applied it to my script. Now I like to know if the variable $to and $bcc are save.

function sendmail($to,$subject,$message,$bcc=NULL){

    //Prevent Email Injection in Your PHP Form to Mail Scripts
    if ( preg_match( "/[\r\n]/", $to ) ||  preg_match( "/[,]/", $to ) || preg_match( "/[\r\n]/", $bcc ) || preg_match( "/[,]/", $bcc ) ) {

        return '<h1>Danger found: possible email Injection Hijacking</h1>';
        return false;

    }else{
        // To send HTML mail, the Content-type header must be set
        $headers  = 'MIME-Version: 1.0' . "\r\n";
        $headers .= 'Content-type: text/html; charset=iso-8859-1' . "\r\n";

        // Additional headers
        $headers .= 'From: No Reply <no-reply@domain.nl>' . "\r\n";
        if(isset($bcc)) $headers .= 'Bcc: ' .$bcc."\r\n";

        // Mail it
        return mail($to, $subject, $message, $headers);
    }
}
sendmail($_REQUEST['email'],'Subjectline', 'message','admin@domain.com');

http://stackoverflow.com/questions/1055460/how-to-sanitze-user-input-in-php-before-mailing — MKroeders, Oct 02 '13 at 13:34
The return false in the first if statement is useless because the function is already returning the string one line above. — Simon Fischer, Oct 02 '13 at 13:34

score 0 · Accepted Answer · answered Oct 02 '13 at 13:36

The vulnerability in mail comes from header injection. To prevent it, you can look for newlines in the header values, ie.:

"BCC: " . $email . "
X-OtherHeader: Foo-Bar

If $email contains a newline, like:

webmaster@domain.com
TO: pro@hackerz.ru

You will get an extra TO header, which is potentially malicious. Header injection allows an attacker to send an email from your mailserver to anyone, essentially turning your mailserver into a spam server.

From the looks of it your current script is safe.

score -1 · Answer 2 · answered Oct 02 '13 at 13:36

-1

Make sure there are only one e-mail replacing $str (string) using:

$str=str_replace(";","",$str);
$str=str_replace(",","",$str);

answered Oct 02 '13 at 13:36

ainos

163
1
6

They can be valid characters in an email address if quoted: http://haacked.com/archive/2007/08/21/i-knew-how-to-validate-an-email-address-until-i.aspx – SilverlightFox Oct 03 '13 at 09:50

What is the best way to prevent email Injection in a mailform?

2 Answers2

Linked