Posted by Gordon Burditt on 09/28/94 11:34

>A spammer is apparently using email injection on my form, however my I
>thought email injection requires mainpulation of the headers parameter
>in mail() and I'm not using that parameter. My mail call looks like:
>
>mail($to,$subj,$body)
>
>So how is the spammer getting me?

Are the contents of $to and $subj in any way whatever dependent
on form input? Is there any way either of those variables could
be made to contain a newline or carriage return? If so, that's
how they are doing it. Remember, the spammer NEED NOT use your
form so any Javascript checking is useless.

Look at the headers of any mail message, and consider what
happens if $subj = "Make Money fast\r\nCc: spamee@aol.com".

Gordon L. Burditt

[Back to original message]