标题注入邮件 [英] header injection in mail
问题描述
我正在写我的php表格邮件脚本。
邮件是否对to中的标题注入进行了任何检查。和
" subject"参数？ CR和/或LF？在我看来它很容易和
应该，但它呢？
杰夫
I''m writing my php "form mail" script.
Does mail do any checking for header injection in the "to" and
"subject" parameters? CR and/or LF? It seems to me it easily could and
should, but does it?
Jeff
推荐答案
..oO(Jeff)
..oO(Jeff)
我正在写我的php" form mail"脚本。
邮件是否对to中的标题注入进行了任何检查。和
主题参数？ CR和/或LF？
I''m writing my php "form mail" script.
Does mail do any checking for header injection in the "to" and
"subject" parameters? CR and/or LF?
编号mail（）是一个相当低级的工具。你有责任提供正确的数据。
BTW：在TO：字段中，CR和LF不是唯一需要担心的事情。 />
这个标题还允许多个以逗号分隔的邮件地址...
No. mail() is a rather low-level tool. You are responsible for feeding
it correct data.
BTW: CR and LF are not the only things to worry about in the TO: field.
This header also allows multiple comma-separated mail addresses ...
>在我看来它很容易就可以和
，但是吗？
>It seems to me it easily could and
should, but does it?
我可以建议PHPMailer吗？
http://phpmailer.codeworxtech.com/
此课程可以完成您想要和需要的所有事情。它不是那么难以习惯它并且它很有效。不容易。
Micha
May I suggest PHPMailer?
http://phpmailer.codeworxtech.com/
This class does all the things you want and need. It''s not that
difficult to get used to it and it works just great. Can''t get easier.
Micha
Michael Fesser写道：
Michael Fesser wrote:
.oO（杰夫）
.oO(Jeff)
>我正在写我的php表格邮件脚本。
邮件是否对to中的标题注入进行了检查。和
主题参数？ CR和/或LF？
> I''m writing my php "form mail" script.
Does mail do any checking for header injection in the "to" and
"subject" parameters? CR and/or LF?
号邮件（）是一个相当低级别的工具。你有责任提供正确的数据。
BTW：在TO：字段中，CR和LF不是唯一需要担心的事情。 />
这个标题还允许多个以逗号分隔的邮件地址......
No. mail() is a rather low-level tool. You are responsible for feeding
it correct data.
BTW: CR and LF are not the only things to worry about in the TO: field.
This header also allows multiple comma-separated mail addresses ...
>在我看来它很容易和<应该，但是吗？
>It seems to me it easily could and
should, but does it?
我可以建议PHPMailer吗？
http://phpmailer.codeworxtech.com/
这个课可以完成你想要的所有事情。需要。它不是那么难以习惯它并且它很有效。不容易。
Micha
May I suggest PHPMailer?
http://phpmailer.codeworxtech.com/
This class does all the things you want and need. It''s not that
difficult to get used to it and it works just great. Can''t get easier.
Micha
你是说PhpMailer过滤掉逗号分隔的电子邮件地址，
CRLF'等等......来自标题？
-
************* ****************
Chuck Anderson？ Boulder，CO
http://www.CycleTourist.com
没有他真正需要的东西
二十一世纪的精神分子。
*************** ********************
Are you saying PhpMailer filters out comma separated email addrs,
CRLF''s, etc., ... from headers?
--
*****************************
Chuck Anderson ? Boulder, CO
http://www.CycleTourist.com
Nothing he''s got he really needs
Twenty first century schizoid man.
***********************************
Michael Fesser写道：
Michael Fesser wrote:
> .oO（Jeff）
>.oO(Jeff)
>>我正在写我的php表格邮件脚本。
邮件是否对to中的标题注入进行了检查。和
主题参数？ CR和/或LF？
>> I''m writing my php "form mail" script.
Does mail do any checking for header injection in the "to" and
"subject" parameters? CR and/or LF?
号mail（）是一个相当低级的工具。您负责为其提供正确的数据。
BTW：在TO：
字段中，CR和LF不是唯一需要担心的事情。这个标题还允许多个以逗号分隔的邮件地址...
No. mail() is a rather low-level tool. You are responsible for
feeding it correct data.
BTW: CR and LF are not the only things to worry about in the TO:
field. This header also allows multiple comma-separated mail
addresses ...
>>在我看来它很容易就可以和
，但是吗？
>>It seems to me it easily could and
should, but does it?
我可以建议PHPMailer吗？
http://phpmailer.codeworxtech.com/
此课程可以完成您想要和需要的所有事情。它并不是很难习惯它并且它的效果非常好。不能轻松搞定。 Micha
May I suggest PHPMailer?
http://phpmailer.codeworxtech.com/
This class does all the things you want and need. It''s not that
difficult to get used to it and it works just great. Can''t get
easier. Micha
你是说PhpMailer过滤掉逗号分隔的电子邮件地址，
CRLF'等等......来自标题？
Are you saying PhpMailer filters out comma separated email addrs,
CRLF''s, etc., ... from headers?
好吧，炒作如：
"让您的电子邮件通过垃圾邮件检查程序的策略，以及针对流行服务器的规格
。
...更多
on他们的开场页面，我会说他们应该钻到地上
，直到他们遇到熔岩，而另一个四分之一英里只是为了好
衡量。这让我很快感到厌恶 - 他们是垃圾邮件发送者
友好而且唯一好的垃圾邮件发送者是一个死垃圾邮件发送者。
Well, with hype like :
" strategies to get your emails past spam checkers, and specifications
for popular servers.
... more "
on their opening page, I''d say they should be drilled into the ground
until they meet lava and than another quarter mile just for good
measure. That soured me on them pretty quickly - they''re spammer
friendly and the only good spammer is a dead spammer.
这篇关于标题注入邮件的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！
