Message regex mailform

[digitalecartoon]

In my mailform field I'm using a name, email and message field. To make them secure agains email injection I'm using the below regexs. I'm just not sure how the write a good message regex. Users will be able to type most characters, even start a new paragraph, but what regex should I use to still make the message field safe agains mail injection while allowing users to do this?

And are the name and email regex correct?

/* Check if name is ok, including special characters like é */
function checkNaam ($name) {
if (preg_match('~^[a-zÀ-ÿ][-'a-zÀ-ÿ \-]*$~i', $name)) {
echo "correct";
} else {
echo "error";
}
}

/* Check if format email address is ok */
function checkEmail ($email) {
if (preg_match('~^[a-z0-9][a-z0-9_.\-]*@([a-z0-9]+\.)*[a-z0-9][a-z0-9\-]+\.([a-z]{2,6})$~i', $email)) {
echo "correct";
} else {
echo "email";
}
}

/* Check if message field is ok */
function checkBericht ($message) {
if (preg_match('~***~i', $message)) {
echo "correct";
} else {
echo "error";
}
}

[NogDog]

Email injection only occurs in the mail headers, so the data you supply as the "message" parameter to mail() is not a concern. The "To", "Subject", and "Additional Headers" parameters are the ones you need to worry about. You might want to use strip_tags() on the message value to ensure it's plain text, unless you intend to allow HTML formatting in the actual message.

[digitalecartoon]

I've now got my mailscript like this:

<?php

/* Email settings*/
$to = "[e-mail]";
$subject = "Een mailtje via de website";
$redirectgoed = "http://www.eventesten.nl/mailsend.htm";
$redirectfout = "http://www.eventesten.nl/mailfout.htm";
$afzender = $_POST["afzender"];
$mailadres = $_POST["mailadres"];
$bericht = $_POST["mailbericht"];

/* Check if name is ok, including special characters like é */ 
if (!preg_match('~^[a-zÀ-ÿ][\'a-zÀ-ÿ \-]*$~i', $afzender)) {
$afzender = "error";
}

/* Check if format email address is ok */ 
if (!preg_match('~^[a-z0-9][a-z0-9_.\-]*@([a-z0-9]+\.)*[a-z0-9][a-z0-9\-]+\.([a-z]{2,6})$~i', $mailadres)) {
$mailadres = "error";
}

/* Strip tags from message */
$bericht = strip_tags($bericht);

/* Mail form sent but no valid name, email address or empty message? Don't send*/
if ($_POST["verstuurknop"] !="Versturen" || $afzender = "error" || $mailadres = "error"; || !$bericht) {
header ("Location: ".$redirectfout);
} else {

/* Everything ok. Send mail! */
$message = "Naam:\r\n".$afzender."\r\n\r\n";
$message .= "Emailadres:\r\n".$mailadres."\r\n\r\n";
$message .= "Bericht:\r\n".stripslashes($mailbericht)."\r\n";

$headers = "MIME-Version: 1.0\r\n";  

$headers .= "Content-type: text/plain; charset=iso-8859-1\r\n";
$headers .= "From: ".mb_encode_mimeheader($afzender, "iso-8859-1", "Q")." <".$mailadres.">\r\n";  

mail($to, $subject, $message, $headers);
header("location:".$redirectgoed);
}
?>

$POST["afzender"] being the senders's name
$POST["mailadres"] the senders email address
$_POST["mailbericht"] the senders mail message

What do you think about my script? Are there any erros in it? Are the regexs for name and email address any good? Safe enough against email injections?

Any comments would be appreciated. Would'nt want a user to have his name/email blocked when they are valid e.g. And want it safe enough against injection.

[NogDog]

Some names have apostrophes in them, e.g. "O'Donnell".

[digitalecartoon]

Thank. Above script in post has been updated. This time the use of apostrophe is added to the name regex. Used an escape character before the apostrophe because Dreamweaver showed it as an error (probably bacause the preg_match is between apostrophes.

Also, since preg_macht is now case insensitive I've deleted the A-Z part. For foreign characters, do I need to change this too? Or does case work differently with foreign (accented) characters?

Edit:
This regex doesn't work:

(!preg_match('~^[a-zÀ-ÿ][\'a-zÀ-ÿ \-]*$~i', $naam))

It should allow for an apostrophe, but it doesn't?

[digitalecartoon]

This is the updated code. I've put the utf8_decode there because I've noticed that Flash form send its values utf8 encoded. So a name like René would show as something like Ren%8 (well, not exactly, but you know what I mean).

But anyway, using this worked for accented letters, so René was send as René to the php script. But now I notice that apostrophes are labelled as false, but I've regex tested my regex:
preg_match('~^{[a-zÀ-ÿ][\'a-zÀ-ÿ} -]*$~i', $naam))
and when I give it a name like Rene O'Brien, is should be true, but it gives a false?

Do you know what's wrong?

<?php

/* Emailinstellingen */
$to = "[e-mail]";
$subject = "Een mailtje via de website";
$naam = utf8_decode($_POST["naam"]);
$email = utf8_decode($_POST["email"]);
$bericht = utf8_decode($_POST["bericht"]);


/* Kijken of er wel een echte naam is ingevuld */
/* Ook de mogelijkheid voor accenttekens open laten */
if (!preg_match('~^[a-zÀ-ÿ][\'a-zÀ-ÿ \-]*$~i', $naam)) {
$naam = "error";
echo "&naam=error&";
} else {
echo "&naam=correct&";
}

/* Kijken of er wel een echt email is ingevuld */
if (!preg_match('~^[a-z0-9][a-z0-9_.\-]*@([a-z0-9]+\.)*[a-z0-9][a-z0-9\-]+\.([a-z]{2,6})$~i', $email)) {
$email = "error";
echo "&email=error&";
} else {
echo "&email=correct&";
}

/* Verwijder html en php tags uit bericht */
$bericht = strip_tags($bericht);
if (!$bericht) {
$email = "error";
echo "&bericht=error&";
} else {
echo "&bericht=correct&";
}

/* Alles ingevuld en geldig emailadres? Dan versturen */
if ($naam != "error" && $email != "error" && $bericht != "error") {

$message = "Naam:\r\n".$naam."\r\n\r\n";
$message .= "Emailadres:\r\n".$email."\r\n\r\n";
$message .= "Bericht:\r\n".stripslashes($bericht)."\r\n";

$headers = "MIME-Version: 1.0\r\n";  

$headers .= "Content-type: text/plain; charset=iso-8859-1\r\n";
$headers .= "From: ".mb_encode_mimeheader($naam, "iso-8859-1", "Q")." <".$email.">\r\n";  

mail($to, $subject, $message, $headers);

}
?>

[digitalecartoon]

I've just discovered that flash sends an apostrophe not as only ', but as /'

utf8_decode fixed the accented characters part
Is there something similar that converts /' back to only ' again?

[digitalecartoon]

Fixed it already. See the Email settings part. What do you think of it now?

<?php

/* Email settings */
$to = "[e-mail]";
$subject = "Een mailtje via de website";
$naam = utf8_decode($_POST["naam"]);
$email = utf8_decode($_POST["email"]);
$bericht = utf8_decode($_POST["bericht"]);
$naam = stripslashes($naam);
$email = stripslashes($email);
$bericht = stripslashes($bericht);
$naam = strip_tags($naam);
$email = strip_tags($email);
$bericht = strip_tags($bericht);


/* Check for name including accented characters and aposrophe */
if (!preg_match('~^[a-zÀ-ÿ][\'a-zÀ-ÿ \-]*$~i', $naam)) {
$naam = "error";
echo "&naam=error&";
} else {
echo "&naam=correct&";
}

/* Check for valid email address */
if (!preg_match('~^[a-z0-9][a-z0-9_.\-]*@([a-z0-9]+\.)*[a-z0-9][a-z0-9\-]+\.([a-z]{2,6})$~i', $email)) {
$email = "error";
echo "&email=error&";
} else {
echo "&email=correct&";
}

/* Has message been filled in? */
if (!$bericht) {
$email = "error";
echo "&bericht=error&";
} else {
echo "&bericht=correct&";
}

/* Send email */
if ($naam != "error" && $email != "error" && $bericht != "error") {

$message = "Naam:\r\n".$naam."\r\n\r\n";
$message .= "Emailadres:\r\n".$email."\r\n\r\n";
$message .= "Bericht:\r\n".$bericht."\r\n";

$headers = "MIME-Version: 1.0\r\n";  

$headers .= "Content-type: text/plain; charset=iso-8859-1\r\n";
$headers .= "From: ".mb_encode_mimeheader($naam, "iso-8859-1", "Q")." <".$email.">\r\n";  

mail($to, $subject, $message, $headers);

}
?>

[kiwibrit]

NogDog wrote:

.....You might want to use strip_tags() on the message value to ensure it's plain text, unless you intend to allow HTML formatting in the actual message.

Is that preferable to htmlspecialchars ? Not trying to stir - but I am concerned with the warnings on strip_tags in the manual.

[digitalecartoon]

Please stir, cause I'm trying to make my script as perfect as possible 😃

I've just read this warning. So this would be better?

/* Email settings */
$to = "[e-mail]";
$subject = "Een mailtje via de website";
$naam = utf8_decode($_POST["naam"]);
$email = utf8_decode($_POST["email"]);
$bericht = utf8_decode($_POST["bericht"]);
$naam = stripslashes($naam);
$email = stripslashes($email);
$bericht = stripslashes($bericht);
$naam = htmlspecialchars($naam);
$email = htmlspecialchars($email);
$bericht = htmlspecialchars($bericht);

And would using htmlspecialchars also prevent email injection just like strip_tags would?

[digitalecartoon]

Just read about htmlspecialchars:
'&' (ampersand) becomes '&'
'"' (double quote) becomes '"' when ENT_NOQUOTES is not set.
''' (single quote) becomes ''' only when ENT_QUOTES is set.
'<' (less than) becomes '&lt;'
'>' (greater than) becomes '&gt;'

So these characters are converted in the plain text mail I get. What would I have to do to get these characters back again in the mail text, so that I don't get "10&gt20" but "10>20" e.g.

Edit: ok, I guess htmlspecialchars_decode. But then the message part would be vulnerable to injection again, cause it sends the message with codes again.

[digitalecartoon]

If someone would to type:
pVariable1<pVariable2<pVariable3
in the text field and I'm using strip_tags I would indeed get in my mail:
pVariable1

Question is, since I would want to allow people to write a text like above, what would I have to do?
I'm using the strip_tags to get just a plain text mail without any html formatting.
And also to make my message text field secure against email injection.
Using htmlspecialchars wouldn't work because when sending
pVariable1<pVariable2<pVariable3
I would get
pVariable1&lt;pVariable2&lt;pVariable3
in my mail text.
And decoding them back with htmlspecialchars_decode wouldn't work either since I would get html formatting again and possible email injection through my message field.

Edit:
To send the emails as plain text mails I'm now using this:

$headers = "MIME-Version: 1.0\r\n";  

$headers .= "Content-type: text/plain; charset=iso-8859-1\r\n";
$headers .= "From: ".mb_encode_mimeheader($naam, "iso-8859-1", "Q")." <".$email.">\r\n";

This ignores any html tags anyway.

So my question: if I use a regex to check the name and email field agains email injection and above code to have the mail send as plain text mail, is a strip_tags() for the message field really necessary anyway?