4 ms·
Really? So you're saying this is a valid e-mail address? "\"Attacker\\' -Param2 -Param3\"@test.com" Let's try it: <?php $sender = "\"Attacker\\
by annnnd 10y ago
Really? So you're saying this is a valid e-mail address?
"\"Attacker\\' -Param2 -Param3\"@test.com"
Let's try it:
<?php
$sender = "\"Attacker\\' -Param2 -Param3\"@test.com";
var_dump(filter_var($sender, FILTER_VALIDATE_EMAIL));
// outputs:
// bool(false)
- thaumaturgy 10y agofilter_var(...) explicitly does not strictly adhere to the RFCs. And yes, that is, technically, a valid email address: "\"Attacker\\' -Param2 -Param3\"@test.com" gets interpreted by the shell (or by PHP, or by whatever else is responsible for handling backslash-escaped entities in quoted strings) as "Attacker\' -Param2 -Param3"@test.com and "Attacker\' -Param2 -Param3" is a valid local-part: https://tools.ietf.org/html/rfc5321#section-4.1.2 https://tools.ietf.org/html/rfc5321#section-4.1.2 (Email addresses suck and this is not me saying that this is sane.)