NamePros.Com - View Single Post - PHP mail function

Originally Posted by pchip

$headers = 'From: contact@xyznet' .
'Received: contact@xyznet' .
'Reply-To: contact@xyznet' . "\r\n";

You need "\r\n" after each header line, so it should look like:

Code:


$headers = 'From: contact@xyznet' . "\r\n" .
    'Received: contact@xyznet' . "\r\n" .
    'Reply-To: contact@xyznet' . "\r\n";

Be very very careful if you are allowing any user input (GET, POST, COOKIE etc) to affect the arguments to your mail function call. Obviously allow a user to set the "to:" field would be bad. A common spammer trick is to put "\r\n" into a "subject:" or "from:" field. The mailer then takes the part after the "\r\n" as a new header (which could be a "to:" , "cc:" or "bcc:" header) and can be used to abuse the form. Many (most?) hosts will protect against this type of attack now, but there is a chance that yours (or someone elses if you give the script to them) will not.