php mail header injection prevention

Question

On the php manual page for mail function, there was a user comment saying "take care to prevent header injection".

In my application, I use the mail function, and the only user input I use as a parameter to the function is the email address.

I do a preliminary check of the email address using the regex ^[_a-z0-9-]+(\.[_a-z0-9-]+)*@[a-z0-9-]+(\.[a-z0-9-]+)*(\.[a-z]{2,3})$.

Will this also prevent against header injection?

Thanks,
jrh

Answer 1

Someone would want to inject something like this:

user_address@domain.com
CC: spam_address1@domain.com, spam_address2@domain.com, spam_address3@domain.com

You do not allow \r\n which is needed for defining new header info. So your application is safe.

Answer 2

Header injection is a risk only if you put user-supplied stuff inside the message headers. One tipical example is using the posted email address to set the Reply-To header.

This is what I use:

$email = preg_replace(array("/\r/i","/\n/i", "/%0a/i", "/%0d/i", "/Content-Type:/i", "/bcc:/i", "/to:/i", "/cc:/i", "/Content\-Transfer\-Encoding\:/i", "/Mime\-Version\:/i" ), "", $email);