Databases
StackOverflow2013
Postsdbo
PO
 

Note that there are some explanatory texts on larger screens.

plurals
  1. PO
    primarykey
    data
    text
    <p>The idea behind email-injection is that attacker inject line feed (LF) in the email headers and so he adds as many headers as he wants. Stripping those line feeds will protect you from this attack. For detailed info check <a href="http://www.phpsecure.info/v2/article/MailHeadersInject.en.php" rel="nofollow noreferrer">http://www.phpsecure.info/v2/article/MailHeadersInject.en.php</a></p> <p>The best practice is to rely on a well-written, frequently updated and widely-used code. For that I would suggest using <a href="http://pear.php.net/package/Mail/" rel="nofollow noreferrer">PEAR_MAIL</a> OR <a href="https://zendframework.github.io/zend-mail/" rel="nofollow noreferrer">Zend_Mail</a></p> <p>If you don't want to load those modules or you need to keep things very simple. You can extract the filtering functionality from those modules. Although I do recommend to use them and frequently update the library so that if new attack appears in future you will just need to update your library (Pear or Zend) and you are done.</p> <p>This is the function that sanitize headers in Pear Mail package:</p> <pre><code>function _sanitizeHeaders(&amp;$headers) { foreach ($headers as $key =&gt; $value) { $headers[$key] = preg_replace('=((&lt;CR&gt;|&lt;LF&gt;|0x0A/%0A|0x0D/%0D|\\n|\\r)\S).*=i', null, $value); } } </code></pre> <p>Zend_Mail uses different filter for email,name and other fields:</p> <pre><code>function _filterEmail($email) { $rule = array("\r" =&gt; '', "\n" =&gt; '', "\t" =&gt; '', '"' =&gt; '', ',' =&gt; '', '&lt;' =&gt; '', '&gt;' =&gt; '', ); return strtr($email, $rule); } function _filterName($name) { $rule = array("\r" =&gt; '', "\n" =&gt; '', "\t" =&gt; '', '"' =&gt; "'", '&lt;' =&gt; '[', '&gt;' =&gt; ']', ); return trim(strtr($name, $rule)); } function _filterOther($data) { $rule = array("\r" =&gt; '', "\n" =&gt; '', "\t" =&gt; '', ); return strtr($data, $rule); } </code></pre>
    singulars
    1. This table or related slice is empty.
    1. POEscape string to use in mail()
      singulars
      1. PTQuestion
    1. PTAnswer
    1. USIMSoP
    1. USLaith Shadeed
    plurals
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. POEscape string to use in mail()
      singulars
      1. PTQuestion
    1. This table or related slice is empty.
    1. VO
      singulars
      1. PO
      1. This table or related slice is empty.
      1. VTUpMod
    2. VO
      singulars
      1. PO
      1. This table or related slice is empty.
      1. VTUpMod
    3. VO
      singulars
      1. PO
      1. This table or related slice is empty.
      1. VTUpMod
    1. COI think there is another attack which allow to add multiple messages after each body. It's not that well documented however. [Suhosin](http://www.hardened-php.net/suhosin/) protects PHP against mail header injection.
      singulars
      1. PO
      1. UShakre
    2. COSeems very interesting library. This is the first time I see it. But how we can make sure it does not have any side effect on the PHP itself, I checked its source code it plays with the PHP internals. Is it used in some large, trusted websites ?
      singulars
      1. PO
      1. USLaith Shadeed
    3. COWell, it ships per default with PHP on Debian ;)
      singulars
      1. PO
      1. UShakre
 

Querying!

 
Guidance
A row detail

Detail views are divided into sections. All the information in the data section comes from columns in the selected row. The other sections display data from other, related rows.

Related data can be related in a to-one or a to-many fashion. Captions of data related in a to-many fashion link to a list view showing a filtered view of the table.

Try moving around until you find a non-empty to-many entry and click on the label to get to one. You can move back to the root by clicking on the database name in the header.

SQuiL has stopped working due to an internal error.

If you are curious you may find further information in the browser console, which is accessible through the devtools (F12).

Reload