|
Posted by Michael Fesser on 12/05/06 18:55
..oO(mantrid)
>The function I have uses eregi()
eregi() should be avoided. The preg_* functions are faster and much more
flexible. Additionally in PHP 6 the ereg extension will be removed from
the core and moved to PECL, so it might not be available by default.
>to check POST data for "cc:" and "subject:"
>what other checks should I be using in my function to tighten my security
>further?
I wouldn't check for any particular header field at all, but for all
kinds of line breaks, which are required to inject malicious headers.
Micha
Navigation:
[Reply to this message]
|