EdgeWalker

I was thinking about simpler ways to help prevent email injection attack that is used on forms that use PHP's mail() function. I thought about a few complex regexp rules, but then decided - what if I just search through all the text in each field and remove any "@" symbols found except for exactly one, which is allowed in the sender field. Then remove any % symbols to prevent new lines.

Is my understanding of the attack too simplistic? It seems like it doesn't matter if they try to inject recipients into the fields because they couldn't put any more than one working address in, and ONLY in the sender field.

grahame

I would sanitise the subject and extra header lines with a regular expression to knock out any \r \n and %0A elements in the subject and extra headers. The rules don't need to be complex.