【问题标题】:PHP Mail() Function injecting "@cp-in-3.webhostbox.net" with "from" address in feedback formPHP Mail() 函数在反馈表单中注入“@cp-in-3.webhostbox.net”和“发件人”地址
【发布时间】:2015-05-27 09:52:22
【问题描述】:

通过反馈表发送邮件时,我遇到了很多问题。首先,该函数在本地主机中发送邮件。但上传到远程服务器后,它停止发送。无论如何,我以某种方式修复了。现在它正在发送邮件,但向“FROM”地址注入了更多字符串。请查看我编写的代码以及收到电子邮件后我收到的代码。

代码====>

<?php

    function putinplace($string=NULL, $put=NULL, $position=false)
    {
        $d1=$d2=$i=false;
        $d=array(strlen($string), strlen($put));
        if($position > $d[0]) $position=$d[0];
        for($i=$d[0]; $i >= $position; $i--) $string[$i+$d[1]]=$string[$i];
        for($i=0; $i<$d[1]; $i++) $string[$position+$i]=$put[$i];
        return $string;
    }

    $from1 = $_POST["email"];
    $from = preg_replace('/[^a-zA-Z0-9@\.]/', ' ', $from1);

    $at_pos = strpos($from, "@");

    $from = putinplace($from, "\\", $at_pos);

    $subject1 = $_POST["subject"];
    $subject = preg_replace('/[^a-zA-Z0-9\']/', ' ', $subject1);
    $message1 = $_POST["body"];
    $message = preg_replace('/[^a-zA-Z0-9\']/', ' ', $message1);
    $to = "emailidtosend@gmail.com";
    $headers = 'MIME-Version: 1.0' . "\r\n";
    $headers = 'From: abc.co.in' . "\r\n". 'Reply-To: emailidtosend@gmail.com' . "\r\n" .'X-Mailer: PHP/' . phpversion();
    $headers .= 'Content-type : text/html; CHARSET=ISO-8859-1' . "\r\n";
    $headers = "From:" . $from . "\r\n";

    if(mail($to,$subject,$message,$headers)){
        echo "<script>alert('Email Sent Successfully. We will Get back to you Very soon.');</script>";
        echo "<script>window.open('contact-us.php', '_self');</script>";
    }else{
        echo "<script>alert('Unable To Send The Email.');</script>";
        echo "<script>window.open('contact-us.php', '_self');</script>";
    }
?>

而输出===>

用户名\@gmail.com@cp-in-3.webhostbox.net(查看“FROM”地址的最后部分)

【问题讨论】:

  • 为什么要在@ 前面加上\?你能在你的 PHP 脚本中打印出$headers 来查看你的邮件服务器是否正在破坏它吗?
  • 这看起来像您正在使用一个网络托管包,您的提供商将发送邮件服务器配置为将域部分附加到您的发件人地址,从而有效地防止您欺骗您的提供商邮件服务器的任何地址不负责。
  • 如果您想获得对邮件的回复,请添加 Reply-To 标头并将其设置为 username@gmail.com
  • @Eric,我在服务器上打印出来了,输出只有“username\@gmail.com”而不是“username\@gmail.com@cp-in-3.webhostbox.net” ;现在为什么我在 @ 之前放了 \ 没有这封邮件是从本地主机完美发送的,而不是从远程主机发送的。为了解决这个问题,我必须放这个。请兄弟帮帮我。

标签: php email code-injection


【解决方案1】:
You do not need to put  via cp-in-9.webhostbox.net 
You need to configure you php.ini file in your web server.

Step 1. Find php.ini file
If it's not there then create one in home directory and add codes below

[mail function]
; For Win32 only.
SMTP = localhost
smtp_port = 25

; For Win32 only.
;sendmail_from = me@example.com

; For Unix only.  You may supply arguments as well (default: "sendmail -t -i").
;sendmail_path = /usr/sbin/sendmail

this path "/usr/sbin/sendmail" is specific to server.
To get yours just create a php file with code 
<?php
phpinfo();
?>

and hit that file from web browser you will get the path value for key sendmail_path

One small and simple example for sending email in php is as :

<?php

// Set up parameters
$to = "Vivek.kumar@xyz.com";
$subject = "Your password";
$message = "<p>Hello Homer,</p>
<p>Thanks for registering.</p>
<p>Your password is: <b>springfield</b></p>
";
$from = "vivek@domainname.com";

$headers = "MIME-Version: 1.0" . "\n";
$headers .= "Content-type:text/html;charset=iso-8859-1" . "\n";
$headers .= "From: $from" . "\n";

// Send email
mail($to,$subject,$message,$headers);

// Inform the user
echo "Thanks for registering! We have just sent you an email with your password.";

?>

【讨论】:

  • 仅代码不是一个完整的答案。请解释一下您修复了什么以及为什么这样做。
猜你喜欢
  • 2010-10-26
  • 1970-01-01
  • 1970-01-01
  • 2012-05-31
  • 1970-01-01
  • 1970-01-01
  • 1970-01-01
  • 2015-10-24
  • 2014-09-22
相关资源
最近更新 更多