Is there an equivalent to mysql_real_escape_string() for email injection? I have a form where the user submits their email. I am afraid that someone could insert a comma separated list of emails and use my site for spamming.
Probably, he is talking of "Tell to friends" form.
Kirzilla
2010-01-27 11:18:32
No, you enter your email in the form and it sends you a confirmation. I'm afraid someone would enter something like '[email protected], [email protected], [email protected]...' and send out an email to a bunch of people
Brian
2010-01-27 11:24:43
+7
A:
You can use filter_var to validate the e-mail address:
if (!filter_var($address, FILTER_VALIDATE_EMAIL)) {
// invalid e-mail address
}
Gumbo
2010-01-27 11:18:05
@Brian: Yes, it will return *false* if you test a string like `[email protected],[email protected]`.
Gumbo
2010-01-27 11:25:22
Does filter_var() allows to create custom validation flags?I'm thinking of applying it to check uniqueness of value in DB.Or it is not a good idea?
Kirzilla
2010-01-27 11:30:46
@Kirzilla: You could write a wrapper function that does both use `filter_var` to validate the address and does a database lookup for uniqueness.
Gumbo
2010-01-27 14:09:23
A:
Simply validate the field against a commonly found regular expression for single email address
function validate_email($e){
return (bool)preg_match("`^[a-z0-9!#$%&'*+\/=?^_\`{|}~-]+(?:\.[a-z0-9!#$%&'*+\/=?^_\`{|}~-]+)*@(?:[a-z0-9](?:[a-z0-9-]*[a-z0-9])?\.)+[a-z0-9](?:[a-z0-9-]*[a-z0-9])?$`i", trim($e));
}
thephpdeveloper
2010-01-27 11:19:14
A:
take a look at this function: http://dreamwave.cms-bg.info/2009/09/24/verify_email-php-function/
I think I've explained it well. That's my blog.
DreamWave
2010-01-27 11:19:58
A:
If your primary concern is, as the question states, to verify that users have not attempted to trick you into spamming for them by entering a comma-separated list of addresses, then isn't the obvious answer to simply check whether there are any commas in the user's input?
Dave Sherohman
2010-01-27 11:27:57