PHP Secure E-mails
In the PHP email script from the previous section, there is a vulnerability.
PHP Email Injection
First, let's look at the PHP code from the previous chapter:
<html>
<head>
<meta charset="utf-8">
<title>tutorialpro.org(tutorialpro.org)</title>
</head>
<body>
<?php
if (isset($_REQUEST['email'])) { // If the email parameter is received, send the email
// Send email
$email = $_REQUEST['email'] ;
$subject = $_REQUEST['subject'] ;
$message = $_REQUEST['message'] ;
mail("[email protected]", $subject,
$message, "From:" . $email);
echo "Email sent successfully";
} else { // If no email parameter is received, display the form
echo "<form method='post' action='mailform.php'>
Email: <input name='email' type='text'><br>
Subject: <input name='subject' type='text'><br>
Message:<br>
<textarea name='message' rows='15' cols='40'>
</textarea><br>
<input type='submit'>
</form>";
}
?>
</body>
</html>
The issue with this code is that unauthorized users can insert data into the email headers through the form.
What happens if a user adds the following text into the input fields of the form?
[email protected]%0ACc:[email protected]
%0ABcc:[email protected],[email protected],
[email protected],[email protected]
%0ABTo:[email protected]
As usual, the mail() function places this text into the email headers, which now include additional Cc:, Bcc:, and To: fields. When the user clicks the submit button, this email will be sent to all the addresses listed above!
PHP Preventing Email Injection
The best way to prevent email injection is to validate the input.
The following code is similar to the one from the previous chapter, but we have added an input validation routine for the email field:
<html>
<head>
<meta charset="utf-8">
<title>tutorialpro.org(tutorialpro.org)</title>
</head>
<body>
<?php
function spamcheck($field)
{
// filter_var() filters email
// using FILTER_SANITIZE_EMAIL
$field=filter_var($field, FILTER_SANITIZE_EMAIL);
// filter_var() filters email
// using FILTER_VALIDATE_EMAIL
if(filter_var($field, FILTER_VALIDATE_EMAIL))
{
return TRUE;
}
else
{
return FALSE;
}
}
if (isset($_REQUEST['email']))
{
// If the email parameter is received, send the email
// Check if the email is valid
$mailcheck = spamcheck($_REQUEST['email']);
if ($mailcheck==FALSE)
{
echo "Invalid input";
}
else
{
// Send email
$email = $_REQUEST['email'] ;
$subject = $_REQUEST['subject'] ;
$message = $_REQUEST['message'] ;
mail("[email protected]", "Subject: $subject",
<?php
if (isset($_REQUEST['email'])) {
// If the email parameter is set, send the email
$email = $_REQUEST['email'];
$subject = $_REQUEST['subject'];
$message = $_REQUEST['message'];
mail("[email protected]", $subject, $message, "From: $email");
echo "Thank you for using our mail form";
} else {
// If no email parameter is present, display the form
echo "<form method='post' action='mailform.php'>
Email: <input name='email' type='text'><br>
Subject: <input name='subject' type='text'><br>
Message:<br>
<textarea name='message' rows='15' cols='40'></textarea><br>
<input type='submit'>
</form>";
}
?>
</body>
</html>
In the code above, we used PHP filters to validate the input:
The FILTER_SANITIZE_EMAIL filter removes illegal characters from an email address.
The FILTER_VALIDATE_EMAIL filter validates the value of an email address.
You can read more about filters in our PHP Filter.