What are the potential security risks associated with using user input directly in email headers in PHP?

Using user input directly in email headers in PHP can lead to security risks such as email header injection attacks, where malicious users can inject additional headers or manipulate existing ones to perform unauthorized actions. To mitigate this risk, it is important to sanitize and validate user input before using it in email headers. 

// Sanitize and validate user input before using it in email headers
$user_email = filter_var($_POST['user_email'], FILTER_SANITIZE_EMAIL);

// Set email headers
$headers = "From: webmaster@example.com\r\n";
$headers .= "Reply-To: $user_email\r\n";
$headers .= "MIME-Version: 1.0\r\n";
$headers .= "Content-Type: text/html; charset=ISO-8859-1\r\n";

// Send email
$success = mail("recipient@example.com", "Subject", "Message", $headers);

if($success) {
    echo "Email sent successfully.";
} else {
    echo "Failed to send email.";
}

Keywords

PHP security risks user input email headers injection vulnerabilities

Related Questions