email header injection prevent & magic quote etc.

[blackhorse]

To prevent the hacker fill in hacker's codes in the $sender to inject into email header.

We do this checking

<?php
$from=$_POST["sender"];
if (eregi("\r",$from) || eregi("\n",$from)){
die("Why ?? 🙁");
}
?>

So if I input the value in the sender text field, such as [e-mail]\r\n, it is supposted to catch the error, but it doesn't, unless I changed the code to

<?php
$from=$_POST["sender"];
if (eregi("\r",$from) || eregi("\n",$from)){
die("Why ?? 🙁");
}
?>

With the

magic_quotes_gpc Off Off
magic_quotes_runtime Off Off

Why $from=$_POST["sender"]; still get the escape slash added?

But if the $from is not from $_POST, if I hard code in the value, then the checking codes will work.

<?php
$from="[e-mail]\r\n";
if (eregi("\r",$from) || eregi("\n",$from)){
die("Why ?? 🙁");
}
?>

So what is difference here between
$from=$_POST["sender"]; (and type in [e-mail]\r\n)
and
$from="[e-mail]\r\n";

Could somebody explain here? Thanks! the magic quote is a tricky part maybe someone else have same confusions as I have now.

Due to the $sender will have to be a valid email, will it be better instead of we only check to see if there is \n, \r in the $sender (where is the header injection happens.), we just check to see if $sender is a valid e-mail? If there is \n or \r in $sender, it will not be a valid e-mail too. This way we will not have to deal with above codes and magic quote issues but still prevent header injection from $sender value, right?

if(!eregi("^{[a-z0-9-]+(.[a-z0-9-]+)@[a-z0-9-]+(.[a-z0-9-]+)(.[a-z]{2,3})$",} $sender))
{
exit("Invalid E-mail");

}

[blackhorse]

Any help?

Say in the form field (textarea) "sender".

1) I input values as

[e-mail]\r\n

or

2) I input values as
[e-mail]
then I will hit the return key

And then I submit the form.

With the magic quotes off, what is the difference in the values I get from the form object senders.

$email=$_POST['sender'];

in above two cases.

Thanks!