in reply to Re: Contact Form
in thread Contact Form
Ewww. No. You forgot the headers. So the mail isn't going anywhere, and worse yet, it's a security hole, since I can fake a "name" param with newlines and send spam using your script. Ick. Ewww.open MAIL,'|/usr/lib/sendmail -t' or die "error with email"; print MAIL "name: ", $query->param(name), "\n"; print MAIL "subject: ", $query->param(subject), "\n"; print MAIL "email: ", $query->param(emailaddy), "\n"; print MAIL "message: ", $query->param(message), "\n";
-- Randal L. Schwartz, Perl hacker
|
|---|
| Replies are listed 'Best First'. | |
|---|---|
|
Re: •security alert, was Re: Re: Contact Form
by Parham (Friar) on Mar 23, 2002 at 00:12 UTC |