Send mail script was hacked?

airjunkie2000

Hello, I am new to the forums and new to writing php code, which is why I am here seeking advice. Yesterday my site was hacked and a sendmail script I use was used to send tons of spam mail. The server place was not happy obviously, and they removed my script, which made it imposssible for people to send pages of my site to frirends.

I have copied the send mail code blow, the inputs to the script are put into a form by the user and this script sends the mail. I have replaced some of the fields with GENERIC entries for security reasons.

All the guys at the server company speek of "securing" your sendail scripts and Im really not sure how to even start doing that. Can it be done to this script? Is it difficult if so can I possible offer payment for help?

Please help me out any advice is good and if my script can't be secured or made hack proof than can someone recomend a good send page script for me....

Thanks

Here's the code.

<?php
$ip = getenv("REMOTE_ADDR");
if (!isset($visitormail) || !isset($friendmail))
echo "<font size=6>Please Try Again</font> $ip" ;
$todayis = date("l, F j, Y, g:i a") ;
$notes = stripcslashes($notes); $messageis = " $todayis [EST] \n
Your Friend: $visitor ($visitormail)\n
Wants you to check this out: $sitename ($urlis) \n
To: $friend $friendmail \n
Your Friends Comments: $notes \n
MY NOTES HERE ( http://www.MYURLHERE/ ) ";
$messageme = $ip . " " . $messageis;

$from = "From: $myemail\r\n";

if ($myemail != "")
mail($myemail, $sitename, $messageme, $from);
if ($friendmail != "")
mail($friendmail, $sitename, $messageis, $from);
?>

Nugen

you got owned by header injection. You should close your headers off for each item manually and check for code injection. This is an example of checking for them with a function:

function RendSMTPInjectCheck($T_DATA_CLEAN) {
	if (!empty($T_DATA_CLEAN)) {
		//check for header injection
		$T_DATA_CLEAN=str_replace("%20", " ", $T_DATA_CLEAN);
		if (eregi("\r", $T_DATA_CLEAN) || eregi("\n", $T_DATA_CLEAN) || eregi("content-", $T_DATA_CLEAN)){
			return 0;
		} else {
			return 1;
		}
	} else {
		return 1;
	}
}

if 0 is returned then the string fails. If 1 is returned then the string is clear. I generally submit the content with: strtolower() wrapped around the values.

airjunkie2000

Im sorry, but how do I run the script you show here? Is the script I show there fixable? Is it tough to do?
Im really new to coding

Nugen

you could use it in many ways. Basically, you would paste that function into your script and use it like any other function in PHP. For instance:

$T_RESULT=RendSMTPInjectCheck($MY_EMAIL_MSG);

if ($T_RESULT==1) {
//my email message is clear
} else {
//my email message has a header injection
}