NYCPHP Meetup

NYPHP.org

[nycphp-talk] worm/virus's hammering feedback scripts?POLISHEDVERSION

Mikko Rantalainen mikko.rantalainen at peda.net
Tue Sep 27 08:03:44 EDT 2005


Hans Zaunere wrote:
> matthijs abeelen scribbled on Thursday, September 15, 2005 2:04 AM:
> 
>>This problem is spreading very fast, a good summery of the best
>>solution(s) is needed indeed. Unfortunately, I'm not the one who can
>>do that. Waiting eagerly for the article on Phundamentals!  
> 
> We're working on it.
> 
> And I've attached what a first stab at a PHP 5 class would look like, with
> example usage here:
> 
> $MyMail = new MailProtect;
> $MyMail->SetFrom($_POST['From']);
> $MyMail->SetTo($_POST['To']);
> $MyMail->SetCc('admin at somwhere.com');
> $MyMail->SetSubject($_POST['Subject']);
> $MyMail->SetBody('Thank you for your submission!');
> 
> if( $MyMail->SendMail() === TRUE )
>     echo 'Mail Sent';
> else
>     echo 'WARNING: Header validation failed; possible exploitation attempt';

How about

$MyMail->addTo(...);
$MyMail->addCc(...);
$MyMail->addBcc(...);

instead of setXXX() variants? From, Subject and Body always have 
exactly one value but To, Cc and Bcc fields can contain multiple 
items. If the protecting wrapper class forces one to add a single 
recipient at a time misuse of these fields is a bit harder by mistake.

Also, I'd prefer those methods to accept two parameters instead of 
just one. For example,

function addTo($email,$display_name="") {...}

So that user of this class never needs to encode any special 
characters or merge display name and email in the same string.

I'd add $MyMail->addHeader($name,$value) for adding a single 
additional header too.

-- 
Mikko



More information about the talk mailing list