Have Geek Brain

By sanitizing user input that will later be emailed - what should I be worried about?

I am interning for an NGO in India (Seva Mandir, http://sevamandir.org ) and trying to fix my broken subscribe to the newsletter. "Since the staff is not very complicated and our web host is not very big, I decided to send the relevant data to the publishing staff via mail (), rather than storing it in the MySQL database.

I know it is best to treat user input as malicious and I searched the SO forums for posts related to escaping user data to send in a mailing. I know the data needs to be escaped; what should i be worried about and what is the best way to misinform the input before sending it via email?

Also note that the org web host is still using PHP 4, so I can't just use filter_var on strings. I am working with them to fix the problem , but for now I have to use regex or strip_tags or some other method.

Form flow:
1. User enters email on the main page and clicks Submit
2. User enters name, address, additional information on the second page (poor usability, I know, but my boss asked me) and clicks Submit
3. Collect data via $ _POST and send an email to the post editor (and possibly send confirmation to the subscriber).

I'm going to misinform the email in step 2 and other data in step 3. I appreciate your help,
Kevin

+2


a source to share


3 answers


You need to know about Email Header Attacks .



Basically, if you separate \n

and \r

from $name

, $from

, $to

and $subject

, you should be safe enough, but it is always better to use a white list.

+1


a source


As far as I know, as long as you use plain text and only insert user input in the body of the email, there is nothing to sanitize.



+2


a source


If you are using a user-entered email address to send confirmation, make sure they only entered one email. A spammer can steal strings, and thus arbitrarily long entries Bcc:

, from message headers if you don't look.

See email .

+2


a source






More articles:


All Articles