Deviation wrote:
I'm sure this is just a basic "here's how to make an email form" type of lesson. There's obviously a lot more code that should go into that to sanitize the variables.
Yeah, people take these lessons, then go ahead and implement it on their own websites with a simple copy and paste. You know how HS students love to copy and paste everything! The result is that we have so many millions of insecure websites all over the place.
It must done right the first time. By using a blacklist, the code above is giving the students the wrong idea to begin with. And a few of them will go on using the insecure approach for years to come. For all you know, they could end up designing sites that you yourself will later sign up on!
There are some gigantic regexes out there (~4KB) that will sanitize email addresses for you, but 99.9% of all email addresses can be quickly validated using a few simple checks.
99.9% of all email addresses only contain a-z, A-Z, 0-9, hyphen (-), underscore (_), plus (+), dot (.), and at (@). Any other character should raise suspicion, so this should be your basic whitelist.
There should be one and only one at (@) sign in an email address. Any more than one is a sure sign of an attempt to spam multiple people. In addition, the at (@) sign should not be at the beginning or end of the address.
The "domain name" portion of the email address should contain at least one dot. Again, the dot should not be at the beginning or end of the domain name.
The RFC is a lot more complicated of course. All of the following characters can appear in the "local" (username) part of an email address:
! $ & * - = ^ ` | ~ # % ' + / ? _ { }
If you know how to incorporate all of this into a regex, fine. But if you think this is too complicated for your purpose, try to figure out how many people you've ever seen with email addresses that contain a slash or ampersand.
It's better to drop a potentially legitimate submission than for your site to be potentially vulnerable. And that's the idea that your students should be getting.
If you're really worried about being too strict, you can use another trick. If an email address is deemed invalid, include it in the body of the message rather than in the From: header. (And stick your own email address instead in the From: header.) You're sending all emails to your own email address anyway, so the worst that can happen is that you'll sometimes have to copy and paste the email address rather than hitting "reply" straight away. This way, you'll also be able to see how many people are trying to hack your code.
As for the other variables, it's a plaintext message so I wouldn't be too paranoid about sanitizing. Some stupid email clients might try to render plaintext messages as HTML and execute scripts in doing so, but I haven't seen such stupid programs recently.
Finally, if you have magic quotes turned on, (it's turned on by default in most distros), PHP will stick a backslash in front of every quote or apostrophe. O'Neill becomes O\'Neill, It's becomes It\'s, and so on. But this is more of a nuisance than a security issue.
FAQ
Search
Members
Register
Login [ Anonymous ]
