Escape string to use in mail()

by

The idea behind email-injection is that attacker inject line feed (LF) in the email headers and so he adds as many headers as he wants. Stripping those line feeds will protect you from this attack. For detailed info check http://www.phpsecure.info/v2/article/MailHeadersInject.en.php

The best practice is to rely on a well-written, frequently updated and widely-used code. For that I would suggest using PEAR_MAIL OR Zend_Mail

If you don’t want to load those modules or you need to keep things very simple. You can extract the filtering functionality from those modules. Although I do recommend to use them and frequently update the library so that if new attack appears in future you will just need to update your library (Pear or Zend) and you are done.

This is the function that sanitize headers in Pear Mail package:

function _sanitizeHeaders(&$headers)
{
    foreach ($headers as $key => $value) {
        $headers[$key] =
            preg_replace('=((<CR>|<LF>|0x0A/%0A|0x0D/%0D|\\n|\\r)\S).*=i',
                         null, $value);
    }
}

Zend_Mail uses different filter for email,name and other fields:

function _filterEmail($email)
{
    $rule = array("\r" => '',
                  "\n" => '',
                  "\t" => '',
                  '"'  => '',
                  ','  => '',
                  '<'  => '',
                  '>'  => '',
    );

    return strtr($email, $rule);
}

function _filterName($name)
{
    $rule = array("\r" => '',
                  "\n" => '',
                  "\t" => '',
                  '"'  => "'",
                  '<'  => '[',
                  '>'  => ']',
    );

    return trim(strtr($name, $rule));
}

function _filterOther($data)
{
    $rule = array("\r" => '',
                  "\n" => '',
                  "\t" => '',
    );

    return strtr($data, $rule);
}

More Related Contents:

  1. Dollar ($) sign in password string treated as variable
  2. PHP quotes inside quotes
  3. Do I need to escape backslashes in PHP?
  4. How do I check if a string contains a specific word?
  5. Split a comma-delimited string into an array?
  6. PHP – concatenate or directly insert variables in string
  7. Why does PHP consider 0 to be equal to a string?
  8. Replacing accented characters php
  9. How to remove accents and turn letters into “plain” ASCII characters? [duplicate]
  10. Convert a comma-delimited string into array of integers?
  11. With “magic quotes” disabled, why does PHP/WordPress continue to auto-escape my POST data?
  12. How to get everything after a certain character?
  13. PHP remove special character from string
  14. Iterate over each line in a string in PHP
  15. Generate SEO friendly URLs (slugs) [closed]
  16. PHP: How can I explode a string by commas, but not wheres the commas are within quotes?
  17. How to get int instead string from form?
  18. Print newline in PHP in single quotes
  19. How can I remove part of a string in PHP? [closed]
  20. PHP String Manipulation: Extract hrefs
  21. How to convert PascalCase to snake_case?
  22. Get last whole number in a string
  23. Include constant in string without concatenating
  24. Remove Trailing Slash From String PHP
  25. Pass a PHP variable to a JavaScript variable
  26. mysql_escape_string VS mysql_real_escape_string
  27. Measure string size in Bytes in php
  28. Explode a paragraph into sentences in PHP
  29. Format 32-character string with hyphens to become UUID
  30. finding common prefix of array of strings

Leave a Comment