PHP Mail()函数注入" @ cp-in-3.webhostbox.net"与"来自"以反馈形式提供地址

时间:2015-05-27 09:52:22

标签: php email code-injection

我在通过反馈表发送邮件时遇到了很多问题。首先,该功能是在本地主机中发送邮件。但在将其上传到远程服务器后,它就停止了发送。无论如何,我以某种方式修复了。现在它正在发送邮件,但是向" FROM"注入了更多的字符串。地址。请看一下我写的代码,以及收到电子邮件后我得到的代码。

代码====>

<?php

    function putinplace($string=NULL, $put=NULL, $position=false)
    {
        $d1=$d2=$i=false;
        $d=array(strlen($string), strlen($put));
        if($position > $d[0]) $position=$d[0];
        for($i=$d[0]; $i >= $position; $i--) $string[$i+$d[1]]=$string[$i];
        for($i=0; $i<$d[1]; $i++) $string[$position+$i]=$put[$i];
        return $string;
    }

    $from1 = $_POST["email"];
    $from = preg_replace('/[^a-zA-Z0-9@\.]/', ' ', $from1);

    $at_pos = strpos($from, "@");

    $from = putinplace($from, "\\", $at_pos);

    $subject1 = $_POST["subject"];
    $subject = preg_replace('/[^a-zA-Z0-9\']/', ' ', $subject1);
    $message1 = $_POST["body"];
    $message = preg_replace('/[^a-zA-Z0-9\']/', ' ', $message1);
    $to = "emailidtosend@gmail.com";
    $headers = 'MIME-Version: 1.0' . "\r\n";
    $headers = 'From: abc.co.in' . "\r\n". 'Reply-To: emailidtosend@gmail.com' . "\r\n" .'X-Mailer: PHP/' . phpversion();
    $headers .= 'Content-type : text/html; CHARSET=ISO-8859-1' . "\r\n";
    $headers = "From:" . $from . "\r\n";

    if(mail($to,$subject,$message,$headers)){
        echo "<script>alert('Email Sent Successfully. We will Get back to you Very soon.');</script>";
        echo "<script>window.open('contact-us.php', '_self');</script>";
    }else{
        echo "<script>alert('Unable To Send The Email.');</script>";
        echo "<script>window.open('contact-us.php', '_self');</script>";
    }
?>

输出===&gt;

用户名\ @ gmail.com @ cp-in-3.webhostbox.net(查看&#34; FROM&#34;地址的最后一部分)

1 个答案:

答案 0 :(得分:0)

You do not need to put  via cp-in-9.webhostbox.net 
You need to configure you php.ini file in your web server.

Step 1. Find php.ini file
If it's not there then create one in home directory and add codes below

[mail function]
; For Win32 only.
SMTP = localhost
smtp_port = 25

; For Win32 only.
;sendmail_from = me@example.com

; For Unix only.  You may supply arguments as well (default: "sendmail -t -i").
;sendmail_path = /usr/sbin/sendmail

this path "/usr/sbin/sendmail" is specific to server.
To get yours just create a php file with code 
<?php
phpinfo();
?>

and hit that file from web browser you will get the path value for key sendmail_path

One small and simple example for sending email in php is as :

<?php

// Set up parameters
$to = "Vivek.kumar@xyz.com";
$subject = "Your password";
$message = "<p>Hello Homer,</p>
<p>Thanks for registering.</p>
<p>Your password is: <b>springfield</b></p>
";
$from = "vivek@domainname.com";

$headers = "MIME-Version: 1.0" . "\n";
$headers .= "Content-type:text/html;charset=iso-8859-1" . "\n";
$headers .= "From: $from" . "\n";

// Send email
mail($to,$subject,$message,$headers);

// Inform the user
echo "Thanks for registering! We have just sent you an email with your password.";

?>