Posted by Michael Fesser on 12/07/06 21:32

..oO(D)

>$headers = "From: {$_POST['name']} <{$_POST['email']}>\r\n" .

This line allows header injection. Never (never!) use user-submitted
data for anything without proper validation.

Micha

[Back to original message]