Use a module that sends e-mail. My favourite is MIME::Lite (despite its name, it can also send simple plain text messages).

You do know that MIME::Lite just uses sendmail don't you? That being the case perhaps you might like to share your rationale for this suggestion.

cheers

tachyon

s&&rsenoyhcatreve&&&s&n.+t&"$'$`$\"$\&"&ee&&y&srve&&d&&print

You do know that MIME::Lite just uses sendmail don't you? That being the case perhaps you might like to share your rationale for this suggestion.

It uses sendmail or Net::SMTP. It fills \n-based security holes by adding whitespace (I believe this is called "folding"), so the mailer doesn't see the new line as a new header.

If you set your To: header to be "foo\@bar.com\nSubject: my own anonymous message\n\nFree pr0n at http://foo.com/!!!\n", MIME::Lite will stop this spammer by doing a simple s/\n/\n /g.

From: real@message.com
To: foo@bar.com
 Subject: my own anonymous message
 
 Free pr0n at http://foo.com/!!!
Subject: real message

This is the real message.
[download]

Sendmail will choke on this 4-line To-header, and the spam is stopped effectively.

Had there not been whitespace in front of the extra lines (note that the line between the fake Subject: and the fake body is NOT empty), the fake Subject: header would have been a REAL header, and the fake body would have been the start of the real body.

This doesn't mean you should don't have to check data yourself - one can still add multiple addresses, and older sendmails send the e-mail regardless of the invalid syntax. But the module does make stupid things a little harder. And it provides nice syntax, calls sendmail in a safe fashion (using an argument list instead of a command string, not that it matters much for constants, but still.). The greatest advantage is that MIME::Lite will let you add an attachment if you later decide to do so. It's a lot harder to do that if you print to sendmail yourself.

- Yes, I reinvent wheels.
- Spam: Visit eurotraQ.

What I don't understand is, with all the responses I have got on this site, no one can help me fix it. Is it really such a hard task to make this script safe to use?! I am a "Seeker of Perl Wisdom"...

If I were going to give this script to someone who is very new to Perl or CGI (like ME!), this would help them out greatly!!

No, you're just making one of the classic blunders of a beginning programmer (when first told that you should comment your code). Here's an excerpt from an article on anti-patterns in the latest (Feb. 2003) Dr. Dobbs journal:

We are all familiar with the basic duh comment

i++; //add one to i

that is an unsung foundation of antipatternery. But, in fact, it does no more damage than clutter the layout and could even be argued to be useful in that it warns the reader that the module-writer is quite thick.

But don't feel bad...the author goes on to reveal a good commenting blunder of her own...we've all made these mistakes at sometime or another, it's just a matter of (un)learning (from) them.

this would help them out greatly!!

No, it would only stop them from reading documentation. Don't give too much information.

- Yes, I reinvent wheels.
- Spam: Visit eurotraQ.