[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: Web-dev Digest, Vol 3, Issue 230

Subject: Re: Web-dev Digest, Vol 3, Issue 230
From: "Richard Wales" <email@hidden>
Date: Thu, 23 Nov 2006 10:15:55 +0000
Delivered-to: email@hidden
Delivered-to: email@hidden
Domainkey-signature: a=rsa-sha1; q=dns; c=nofws; s=beta; d=gmail.com; h=received:message-id:date:from:to:subject:in-reply-to:mime-version:content-type:references; b=d850ZeON1gcRQSLHcZnFwWiYw4zyLiw3DeZdcxJxn8nfq/BsPfv+Ktzm738hPxyhP6pWatYdn1hknMGItm/KYvQXbkuMyHwlyDs9pkx/WtGVtYH7doY31ulgJz/IQUrSe+Uejnx/AYsohE7Pj0gb231fJTQdwghNxtwwuuUTk6A=

Hi Mark,

I agree with Scott, this is a problem you should fix pronto or you risk getting your domain RBL-ed and/or your ISP account blocked.

>Regarding cleaning the email, I am doing that... as least I think I
>am. Here's the cleaning routines:
> ...
>if (preg_match(' /[\r\n,;"]/ ', urldecode($_REQUEST['email']))

> ...

I think your are going about this the wrong way. Instead of looking for blacklisted characters i.e. \r, \n, etc. you should check for acceptable data and ban everything else. This is the proactive white list in contrast to reactive blacklist argument.

In practice, there are many regex out there that can identify a valid e-mail address. You may want to try one. There's a very good article on validating e-mail addresses here: http://www.regular-expressions.info/email.html

Good luck,

Richard.

 _______________________________________________
Do not post admin requests to the list. They will be ignored.
Web-dev mailing list      (email@hidden)
Help/Unsubscribe/Update your Subscription:
http://lists.apple.com/mailman/options/web-dev/email@hidden

This email sent to email@hidden

Prev by Date: Re: Browser timeout and php script question
Next by Date: Re: Email spam - possible problem.
Previous by thread: Safari
Next by thread: JavaScript detect of Flip4Mac plugin
Index(es):
- Date
- Thread

Home