$_SERVER['HTTP_REFERER'] to secure mailscripts?

olaf

Hello,

I got the last time much more to do with people trying to crack my php mail script. 🆒

I a php mail script on my website to send mails with a contact form. And I noticed that there are several try-outs for relay spam. (check this link for more information:
http://www.google.com/search?hl=en&lr=&q=jrubin3546%40aol.com&btnG=Google+Search

I prepair this kind of attacks with removing "\r\n" from all posted header fields. But I want to do more: Using $_SERVER['HTTP_REFERER'] to check if the request comes from my own mail form. I know that sometimes the referer information is not send by some browsers. Is my contact form still accesible for all users?

drew010

well, not only is the http referer unreliable in many cases, its also extremely easy to spoof, most of the spammers that use vulnerable mail forms write scripts to exploit them. setting the referrer is extremely easy, and no problem for them to bypass. implementing a sort of captcha image is the best way, or hardcode the recipient email address into the form so they cant send emails to anyone they want, or add extra text to the email so that they wont want to send spam with your extra words in it.

olaf

I think I'm safe ... maybe you like to check its the contact form on my home (the php classes website)

Thanks...

But the question was more is it possible for everyone to use a form like i described?