Re: Yet another email question

[amphiplex]

Hi !

I cant believe that this works, you have not specified any recipients ? Or ary you using some custom mail ?

Aside from this:

• You really should be using a module, especially when using this in a CGI-Script
• If you absolutely must use the mail binary, make sure to check the variables. If you don't check the user input here, someone could, for example, give you a dirname of "; mail [e-mail] < /etc/passwd". So strip out at least: [&;<>"'`|]
• use the absolute path to your mail binary, something like /usr/bin/mail

---- amphiplex

[Aristotle]

No no no. Don't strip out blacklisted characters. Instead, strip out any but whitelisted ones. For example, s/\W+//g. It is too easy to overlook something otherwise.

bikeguy: you probably want to read perlsec. Also, Ovid's excellent CGI course has a good easily digestible discussion of CGI script security.

Makeshifts last the longest.