Validating a form for email exploits is not working

Question

Hello, I have a contact form in my website. I made a class to handle the whole process. But there is something not working in it.

I have 2 functions to check for exploitation and they are not working. I don't know what's wrong with them, so here they are :

private function _validateExploit($val) {
    $exploitPattrens = array('content-type', 'to:', 'bcc:', 'cc:', 'document.cookie', 'document.write', 'onclick', 'onload', '\n', '\r', '\t', '%0A', '%0D', '%08', '%09');

    foreach ($exploitPattrens as $exploit) {
        if (strpos($exploit, $val) !== false){
            return true;
        }
    }
    return false;
}

public function isExploit () {

    if(call_user_func_array(array($this, '_validateExploit'), $_POST)) {
          echo $errorMsg;
     }
 }

When I call isExploit() it always return false, no matter what I give it as an input.

I guess there is something wrong with the call_user_func_array, but I can't find it.

Thanks in advance!

Answer 1

strpos($exploit, $val) should be strpos($val, $exploit)

You also have echo $errorMsg; but $errorMsg is never defined.

And I think you probably want array_walk ( http://us3.php.net/manual/en/function.array-walk.php ) rather than call_user_func_array. I would just loop through $_POST rather than use either of those functions though. I don't think they really buy you anything in this case - and they might not return values the way you are expecting.

Answer 2

You are passing the $_POST variable to the function. $_POST is an array as the call_user_func_array() function requires, but you are not treating it like an array in the _validateExploit function. You are treating it like a string. You need to loop through the $val array as well testing each item in that array or just pick one. You also have your haystack and needle reversed in strpos() as indicated in another answer.

private function _validateExploit($val) {
    $exploitPattrens = array('content-type', 'to:', 'bcc:', 'cc:', 'document.cookie', 'document.write', 'onclick', 'onload', '\n', '\r', '\t', '%0A', '%0D', '%08', '%09');

    foreach ($exploitPattrens as $exploit) {
        foreach ($val as $itm) {
            if (strpos($itm, $exploit) !== false){
                return true;
            }
        }
    }
    return false;
}