当前防止 PHP 中电子邮件注入攻击的最佳实践是什么？

发布于 2024-07-18 08:48:50 字数 1110 浏览 5 评论 0原文

如今，清理 PHP 电子邮件表单中的数据的最佳实践是什么？

我目前正在使用类似的东西...

$msg = $_POST['msg'];
$email = filter_var($_POST['email'], FILTER_VALIDATE_EMAIL);
$name = $_POST['name'];

$subject = "Message from the MY_WEBSITE website e-mail system";
$message = "From: " . $name . "\n";
$message .= "Email: " . $email . "\n\n";
$message .= $msg;
$headers = "From: " . $email . "\r\n" .
           "Reply-To: " . $email . "\r\n" .
           "X-Mailer: PHP/" . phpversion();

$mailSuccess = mail("[email protected]", $subject, $message, $headers);

以这种方式简单地过滤电子邮件字段是否足以提供足够的保护？我可以/应该更有效地强化脚本以防止垃圾邮件发送者吗？

提前致谢！

[编辑]澄清，因为到目前为止的答案表明我没有很好地解释自己。

我主要关心的不是垃圾邮件机器人获取此脚本，而是任何人利用它向 [电子邮件受保护]。这可能包括机器人，但同样可能是人类通过验证码测试。

我正在寻找的是 PHP，它将确保 mail() 方法发送的电子邮件不被劫持。这可能是一个正则表达式或过滤器或类似的东西，只是简单地删除某些字符。再次感谢。[/编辑]

原文

What's considered the best practice these days for sanitizing data from a PHP email form?

I'm currently using something like this...

$msg = $_POST['msg'];
$email = filter_var($_POST['email'], FILTER_VALIDATE_EMAIL);
$name = $_POST['name'];

$subject = "Message from the MY_WEBSITE website e-mail system";
$message = "From: " . $name . "\n";
$message .= "Email: " . $email . "\n\n";
$message .= $msg;
$headers = "From: " . $email . "\r\n" .
           "Reply-To: " . $email . "\r\n" .
           "X-Mailer: PHP/" . phpversion();

$mailSuccess = mail("[email protected]", $subject, $message, $headers);

Is it sufficient protection to simply filter the email field in this fashion? Can/should I harden the script more effectively to protect against spammers?

Thanks in advance!

[EDIT]Clarification, since the answers so far suggest that I've not explained myself well.

I'm not principally concerned with spambots getting hold of this script, but with anyone utilizing it to send illicit emails to any address other than [email protected]. This might include a bot, but could equally be a human defeating a CAPTCHA test.

What I'm looking for is PHP that will ensure that the email sent by the mail() method is not hijacked. This is probably a regex or filter or similar that simply strips certain characters. Thanks again.[/EDIT]

分享到QQ

分享到微博

如果你对这篇内容有疑问，欢迎到本站社区发帖提问参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。

发布评论

需要登录才能够评论，你可以免费注册一个本站的账号。

南…巷孤猫 2024-07-25 08:48:50

我会这样做：

使用验证码；
如果主题或正文包含任何 HTML 标签，则发送失败。注意：我并没有说把它们去掉。只是不要发送电子邮件并向用户提供错误消息原因。向自己发送经过过滤的垃圾邮件是没有意义的。只是不要发送它；
去掉任何高位或低位字符（filter_vars() 可以做到这一点）；
将消息限制为 4000 个字符（或您选择的其他适当限制）；
如果消息包含任何不指向当前站点的 URL，则失败；
可以说使用如何阻止脚本编写者每秒数百次攻击您的网站？以确保有人发送消息。