[RESOLVED] Feedback form Xmailer

[Awestruck]

I have used feedback forms for many years now and in many websites.
The handler typically ends with something like this:

$messageproper =
          "This message was sent from:\n" .
          "$http_referrer\n" .
          "------------------------------------------------------------\n" .
          "Name of sender: $username\n" .
          "Email of sender: $useremail\n" .
          "Telephone No: $phone\n" .
          "W98,ME,2000?: $w98me2000\n" .
          "XP?: $xp\n" .
          "Vista?: $vista\n" .
          "Windows7?: $w7\n" .
          "Computer?:$computer\n" .
          "Computer?;$desktop\n" .        

          "------------------------- MESSAGE -------------------------\n\n" .
          $suggestion .
          "\n\n------------------------------------------------------------\n" ;
mail($mailto, $subject, $messageproper, "From: \"$username\" <$useremail>" . $headersep . "Reply-To: \"$username\" <$useremail>" .
$headersep . "X-Mailer: feedback4.php 2.07" ); header( "Location: $thankyouurl" ); exit ;
?>

I would be grateful for an explanation of this item in the last line:

"X-Mailer: feedback4.php 2.07" );

I don't understand it.

It seems to have a bracket missing to match the one after the 2.07".

Also the php 2.07 seems very outdated as I am using PHP 5.4

If I change the 2.07 to 5.4 it still works.

I also don't understand "feedback4.php" as the my form handler is called form-handler.php

Despite these items the form always works.

Please would you let me know how the line should be written.

I look forward to your advice.

[bradgrafelman]

Awestruck;11025285 wrote:

I have used feedback forms for many years now and in many websites.

Yikes, I hope that's not actual code you've used before, as there are numerous problems with it:

1. It places user-supplied data directly into the mail header. This will leave you vulnerable to header injection attacks (essentially turning you into an open relay). We already have enough spammers in the world - stop helping them out!

2. It forges the 'From' address. This isn't directly a problem, but it is when you don't specify a valid 'Sender' address that points to your mail server.

3. It doesn't specify very many headers that make it appear as a valid message.

4. It duplicates the 'To' header (which is supposed to be specified via the first parameter in the call to [man]mail/man).

5. It doesn't check to see if mail() returned FALSE, indicating an error occurred.

Awestruck;11025285 wrote:

I would be grateful for an explanation of this item in the last line:

"X-Mailer: feedback4.php 2.07" );

I don't understand it.

It seems to have a bracket missing to match the one after the 2.07".

It's certainly not missing - it can be found two lines before that one right after the word 'mail'. You should consider finding a decent code editor, as even the most basic ones provide matching brace highlighting/locating functionality.

Awestruck;11025285 wrote:

Also the php 2.07 seems very outdated as I am using PHP 5.4

Who ever said the "2.07" has anything to do with your PHP version? Or even PHP at all for that matter?

Awestruck;11025285 wrote:

If I change the 2.07 to 5.4 it still works.

You could eliminate it altogether and it shouldn't have any effect; any mail headers that begin with "X-" are (according to RFC standards) only informational items your MTA is to pass along when it delivers the message. In other words, the X-Mailer header really doesn't do a thing.

[dalecosp]

bradgrafelman wrote:

It places user-supplied data directly into the mail header.

Well, I think you're assuming the data is user-supplied and unaltered.

You're probably right, of course, but there's no indication in the supplied snippet of where those variables are coming from. They could have cleaned them up.

I will certainly second your point, though. I hate mailer scripts ... even some of my own have been found exploitable in one way or another (but usually it's just one I've inherited).

Without going to far as to Google it for the OP, there are resources out there that should be read and understood in order to be a responsible citizen of the 'Net. ;-)

[Awestruck]

Many thanks bradgrafelman for your very prompt and helpful reply.

You have alarmed me with your very welcome warning.
Please tell which bits of the code I can safely delete.

Here is the code again together with an extract from the contact form

<?php
// -------- SET THE EMAIL HEADINGS ------------------------
// $mailto - set to the recipient's email address (who you want to send the form to), eg the website owner Fred Bloggs
$mailto = "[e-mail]" ;
$subject = "Enquiry for Fred Bloggs Emporium" ;
$formurl = "http://www.fred-bloggs.co.uk/contact.php" ;
$errorurl = "http://www.fred-bloggs.co.uk.co.uk/error.html" ;
$thankyouurl = "http://www.fredbloggs.co.uk/thankyouform.html" ;
$emailerrurl = "http://www.fred-bloggs.co.uk.co.uk/emailerr.html" ;
$errorphoneurl = "http://www.fred-bloggs.co.uk.co.uk/phonerror.html" ;
$errorsuggesturl = "http://www.fred-bloggs.co.uk.co.uk/suggesterror.html" ;
$uself = 0;
// --- THE $POST array receive items from the contact form and converts them to $ values ---
$headersep = (!isset( $uself ) || ($uself == 0)) ? "\r\n" : "\n" ;
$username = $POST['username'] ;
$useremail = $POST['useremail'] ;
$phone = $POST['phone'];
$comment = $_POST['comment'] ;
$http_referrer = getenv( "HTTP_REFERER" );

Various filters go here to clean the input and ensure that the fields have been filled out

$messageproper =
"This message was sent from:\n" .
"$http_referrer\n" .
"------------------------------------------------------------\n" .
"Name of sender: $username\n" .
"Email of sender: $useremail\n" .
"Telephone No: $phone\n" .
"------------------------- MESSAGE -------------------------\n\n" .
$comment .
"\n\n------------------------------------------------------------\n" ;
mail($mailto, $subject, $messageproper, "From: \"$username\" <$useremail>" . $headersep .
"Reply-To: \"$username\" <$useremail>" .
$headersep . "X-Mailer: feedback4.php 2.07" );
header( "Location: $thankyouurl" );
exit ;

Would you please be kind enough to rewrite the last five lines for me so that they are safe and don't duplicate anything?
Thanks again

[dalecosp]

Sure:

/*
mail($mailto, $subject, $messageproper, "From: \"$username\" <$useremail>" . $headersep . 
"Reply-To: \"$username\" <$useremail>" . 
$headersep . "X-Mailer: feedback4.php 2.07" ); 
header( "Location: $thankyouurl" ); 
exit ;
*/

:evilgrin:

It's not the last five lines that matter in this case. You need to work up top where the data is first made available. See the link I posted for a start.

[Awestruck]

Many thanks dalecosp

I left in the header for relocating to the thankyou page and the code was then:

/mail($mailto, $subject, $messageproper, "From: \"$username\" <$useremail>" . $headersep .
"Reply-To: \"$username\" <$useremail>" .
$headersep . "X-Mailer: feedback4.php 2.07" );/
header( "Location: $thankyouurl" );
exit ;

I have now deleted the code between the comment tags.

That worked fine.

Your other point was covered in my previous code by my comment as follows:
"Various filters go here to clean the input and ensure that the fields have been filled out"

Thanks again and keep up the good work.
I don't know how we would cope without the forum.

[dalecosp]

I apologize that my cynicism and effort to be humorous didn't work. If you want your script to send email, you'll want to enable those lines you've removed.

Various filters go here to clean the input and ensure that the fields have been filled out

Show us the code that does this, and we might be able to suggest improvements. As it is, we can't even offer an opinion on whether your mail call is safe. 🙂

[Awestruck]

Hello dalecosp

Now you really have confused me.
With the lines removed, the email is sent, no problem. To prove it, I altered the handler on two other websites and they also sent the email.

I am not concerned about the body of the handler, that uses FILTER_VAR and validation or sanitization.

My query was purely to do with the X-mailer which I did not understand.

The emails are sent with or without the lines I deleted.

[dalecosp]

In that case, why is this thread still open? Brad G. answered that long ago.

bradgrafelman;11025297 wrote:

any mail headers that begin with "X-" are (according to RFC standards) only informational items your MTA is to pass along when it delivers the message. In other words, the X-Mailer header really doesn't do a thing.

MTA is "Mail Transfer Agent", or, in other words, the mail server. If you want to tell something to the machines (not the people, usually) who'll be receiving your mail, you add X- headers to the message.

mail($mailto, $subject, $messageproper, "From: \"$username\" <$useremail>" . $headersep . "Reply-To: \"$username\" <$useremail>" . 
$headersep . "X-Mailer: feedback4.php 2.07" . $headersep . "X-Notspam: This is not spam, really!" . $headersep . "X-Whitelist: please_whitelist_my_address".$headersep."X-Mail-Priority: medium");

Please consider marking the thread resolved if your original question has been answered.