这种形式安全吗？

Question

我有这种形式,用户通过该表单向我发送电子邮件.我不知道它是否安全,或者只有涉及sql时才出现安全问题...

HTML:

<form id="form4" action="send_mic.php"  name="form4" method="post" >

           <textarea name="message4" cols="4" rows="4"  id="message4" ></textarea><br />

           <input type="text"  id="name4" name="name4" value="" /><br />

           <input type="text"  id="email4" name="email4" value=""  /><br />

          <input type="submit" value="" id="submit" />

</form>

jQuery的:

<script type="text/javascript">
$(document).ready(function () {
    $('#form4').ajaxForm({
        beforeSubmit: validate
    });

    function validate(formData, jqForm, options) {
        var name = $('input[name=name4]').fieldValue();
        var email = $('input[name=email4]').fieldValue();
        var message = $('textarea[name=message4]').fieldValue();

        if (!name[0]) {
            alert('Please enter a value for name');
            return false;
        }
        if (!email[0]) {
            alert('Please enter a value for email');
            return false;
        }
        if (!message[0]) {
            alert('Please enter a value for message');
            return false;
        }

        else {

        $("#content").fadeOut(1000, function () {
            $(this).html("<img src='images/postauto3.png'/>").fadeIn(2000);
        });

        var message = $('textarea[name=message4]').val('');
        var name = $('input[name=name4]').val('');
        var email = $('input[name=email4]').val('');

            } 
    }

});



    </script> 

PHP:

<?php
        if($_POST){
                $email = $_POST['email4'];
                $name = $_POST ['name4'];
                $message = $_POST ['message4'];
                // response hash
                $ajaxresponse = array('type'=>'', 'message4'=>'');

                try {
                        // do some sort of data validations, very simple example below
                        $all_fields = array('name4', 'email4', 'message4');

                        foreach($all_fields as $field){
                                if(empty($_POST[$field])){
                                        throw new Exception('Required field "'.ucfirst($field).'" missing input.');
                                }
                        }

                        // ok, if field validations are ok
                        // now Send Email, ect.

                        // let's assume everything is ok, setup successful response
                        $subject = "New Contact";
                        //get todays date
                        $todayis = date("l, F j, Y, g:i a") ;

                        $message = " $todayis \n
                        Attention: \n\n
                        Please see the message below: \n\n
                        Email Address: $email \n\n
                        Message: $message \n\n

                        ";

                        $from = "From: $email\r\n";


                        //put your email address here
                        mail("contact@....ro", $subject, $message, $from);

                        //prep json response
                        $ajaxresponse['type'] = 'success';
                        $ajaxresponse['message'] = 'Thank You! Will be in touch soon';  
                } catch(Exception $e){
                        $ajaxresponse['type'] = 'error';
                        $ajaxresponse['message'] = $e->getMessage();
                }
                // now we are ready to turn this hash into JSON
                print json_encode($ajaxresponse);
                exit;
        }
?>

那么,使用表单发送电子邮件时是否存在安全问题？这个可以吗？谢谢!

Answer 1

通常,拇指规则应始终为:永远不要信任用户提供的数据.不,你的代码不是防弹.由于您不验证也不清理用户输入,因此您mail()在使用时容易受到攻击.用户可以轻松为您提供精心设计的价值email4.由于您直接使用表单数据,因此可以使用email4向您的外发邮件注入其他邮件头.这些标题将是BCC:或CC:甚至TO:然后你将只是作为垃圾邮件中继.例如,如果我发布这个

some@address.com
CC: spamvictim1@foo.com, spamvictim2@foo.com, spamvictim3@foo.com,
X-Spam-Owned: Whoa

如您email4那么你的头会结束看起来像这样:

To: some@address.com
CC: spamvictim1@foo.com, spamvictim2@foo.com, spamvictim3@foo.com, 
X-Spam-Owned: Whoa

要发布多行数据,您只需将文本与CRLF粘合在一起即可.

为了避免像这样的安全漏洞,你应该考虑放弃mail()并使用更聪明的东西来处理这样的事情(不是那么mail()糟糕,但是你需要知道你在做什么,因为它比高级功能要低).我建议使用PHPMailer或类似的包.您应该始终验证用户提供的数据(特别是确保单行字段,如主题实际上是单行 - 剥离CRLF就足够了).在您自动提交表单时添加验证码.