tags:

views:

81

answers:

3

Hello,

The code below contains some PHP code that allows users to send out email invites to others. It works fine. However, I'm trying to add a function called "check_porn_terms" so that no user could enter their name as "porn" or other vulgar terms and then send an email under that name recommending my site. The variable "$_POST['sendername']" is the user's name.

The function below does not work. Any idea how I can get it to work?

Thanks in advance,

John

function check_porn_terms($input) {
    $porn_terms = array("porn", "sex", "etc.");

    return !preg_match('#\b(' . join('|', array_map('preg_quote', $porn_terms)) . ')\b#i', $input);
}


$sendername = $_POST['sendername'];
$sendername = strtolower($sendername);

if(!check_porn_terms($sendername))
{

   session_write_close();
   header("Location:http://www.site.com/friends.htm");
   exit;

}

$msg = "<html><body>Hello, your friend ".htmlspecialchars($_POST['sendername'])." recommends that you use <a href='http://www.site.com/'&gt;Site.com&lt;/a&gt;&lt;br&gt;&lt;br&gt;&lt;img src='http://site.com/images/blacklogo.PNG'&gt;&lt;/body&gt;&lt;/html&gt;";
$subject = "Try out Site.com";
$headers  = 'MIME-Version: 1.0' . "\r\n";
$headers .= 'Content-type: text/html; charset=iso-8859-1' . "\r\n";
$headers .= 'From: ' . $_POST['sendername'] . "\r\n";
foreach($_POST['email'] as $email){
mail($email, $subject,$msg,$headers);
}
A: 

I figured it out: I had to add

ob_start();

at the top of the code, in the header. I think this is because I was using this:

header("Location:http://www.site.com/friends.htm");
John
+5  A: 

You are going down a slippery slope in trying to stop this as noted above by the clbuttic reference. Even when you get the above code to work it can be very easily circumvented and you will be fighting this battle constantly AND you will inadvertently cause side effects such as blocking good words. You may want to reconsider your tactic on this.

Read these for some thoughts on this:

http://thedailywtf.com/Articles/The-Clbuttic-Mistake-.aspx

http://www.codinghorror.com/blog/archives/001176.html

Mind you, I think it's admirable to try and stop vulgarity and I would love to know of a better technique in the software world for solving this... (I'm sure someone's figured a better way).

klabranche
How can the function be circumvented?
John
In your case, I know you are limiting it to word boundaries and on the name field so it's far more limited in scope. However, not knowing the possibilities on the sendername field I believe you could have issues. What if someone used JoePornoStar....? If this is someone sending email invites why allow the sender name? Make it set to the User Names full name in their settings if you have that for example.... Just some thoughts on it....
klabranche
Here're a few for you: "hot s3x" "hot six" "hot s*x" "hot s.x" "hot sxe" "hotsex", etc. etc. Suffice it to say, if I were a spammer trying to send porn spam using your form, I could trivially come up with a hundred unfiltered variations of any word you filter.
Frank Farmer
Also, what if by chance someone's name was Joe Breast and you add Breast to the list?
klabranche
How can this be circumvented? You must not read much spam that is trying to "de-flaccidate your magic wand with harbal v1agra"
JohnFx
@JohnFx: I do try to avoid it myself. @klabranche: What an unfortuanate name to be stuck with. Then again, I once knew a man called Brik Wall, so anything is possible...
Matthew Scharley
A: 

function check_porn_terms($input) { $porn_terms = array("porn", "sex"); $r = '(' . implode('|', array_map('preg_quote',$porn_terms)) . ')is'; $ok = preg_match($r, $input,$m); return !$ok; }

Usually i don't use \b (word boundary) to match words. and yeah, probably is your Location: header

thephpdeveloper