AAAGGHH!!! Mail Form HiJacked!! AGAIN!!

[kona72]

My script has been hijacked!!
I originally posted here http://www.phpbuilder.com/board/showthread.php?t=10308538
And have since made the suggested changes, but just recently I have been getting 20-40 emails and hour with HUNDREDS of email addresses in them sending spam from ME!!!

Here is the code I am using...

if(isset($Submit))
{
	if($name != "" && $email != "")
	{
		$message = "Quote Request from Website:<br><br>
		Name: $name<br>
		Email: $email<br>
		Location: $where<br>
		Comment/Question: $needs<br>
		Phone Number: $number";

	$headers = "MIME-Version: 1.0\n"; 
	$headers .= "Content-Type: text/html; charset=iso-8859-1\n"; 
	$headers .= "From: <$email>\n"; 
	$headers .= "Reply-To: <$email>\n"; 
//comment this is the new code
		if (strstr($email, '@') == '@trafick.net') {exit('nice try');} 
		mail("[e-mail],$email", "Quote Request from Website", $message, $headers); 


	header("Location: thanks.htm");
}
else
{
	$error = "y";
}
}
?>

This is the send mail portion of the page.... I need help!!! I am "sending" about 2000+ emails per hour..

HELP!!!!

[_theworks]

if you are using a form to send mail... why not use some form of visual authentication? that would stop most automated attempts but im not exactly sure as to what your doin?

[jazz_snob]

If you must put fields from the submitted form, clean them up:
http://www.anders.com/projects/sysadmin/formPostHijacking/

Myself, I don't put any form info into headers for simple forms where the user is just filling out a request for info. The from is always [email]webmaster@my_domain.com[/email] and the to address is the admin for the site or similar (ie fixed address). I put all their entered info into the body of the email. Works great. No clients have complained yet about this script on their site(s).

[kona72]

jazz_snob wrote:

If you must put fields from the submitted form, clean them up:
http://www.anders.com/projects/sysadmin/formPostHijacking/

Myself, I don't put any form info into headers for simple forms where the user is just filling out a request for info. The from is always [email]webmaster@my_domain.com[/email] and the to address is the admin for the site or similar (ie fixed address). I put all their entered info into the body of the email. Works great. No clients have complained yet about this script on their site(s).

Hey Jazz_Snob,
Thanks for the feedback. As far as no form info in headers?? Can you supply and example??

Thanks!!

[jazz_snob]

I wont bother w/ form, but here is how I process it. I get $name, $email, and $interest from the form fields. The only drawback is when you reply to someone you have to change to 'to' address to their email, otherwise you'll just send an email to [email]you@your_email.com[/email].

//avoid really long messages
if( strlen( $interest ) > 1024 ) { 
    $interest=substr( $insterest, 0, 1024 );
}
// try to eliminate incomplete submissions
if( trim( $name ) != "" && trim( $email ) != "" && trim( $interest ) != "" ) {
    $date = date( "Y-m-d H:i:s" );
    $to = 'you@your_email.com';	
    $subject="your_domain.com request for info";

$body =  "Request for information\r\n\r\n";
$body .= "Date: $date\r\n";
$body .= "Name: $name\r\n";
$body .= "Email: $email\r\n";
$body .= "Requested information:\r\n\r\n";
$body .= "$interest\r\n\r\n";

$params= "From: webmaster@{$_SERVER['SERVER_NAME']}\r\n";
$params .= "X-Mailer: PHP/" . phpversion();

mail( $to, $subject, $body, $params);
}