Email Injection (hacking forms) How to stop it?! 4

[DaRNCaT]

I've had my website contact form sending through remarkably strange stuff recently, which after doing some searching, I've discovered is happening to a few people.
Apparently it's called Email Injection, and it's allowing hackers to use the email forms to send spam mail.

I'm trying to set up a function to check and block any attempts, from what I've read carrage returns and new lines plus Bcc and the email address it's getting bcc'ed to are things I could use, but I'd like to make a nice function that I can apply to all fields (apart from email) to stop any nasties - this means I need to allow for customers typing in things like @ unfortunatly.

so far I have thisbased on stuff I've found on the web)
This is checking the $name field.

if (eregi("\r",$name) || eregi("\n",$name) || eregi("%0A",$name) || eregi("%oa",$name)
   || eregi("%0D",$name)|| eregi("%od",$name) || eregi("mhkoch321@aol.com",$name) || eregi("Bcc",$name)){
     $fn2 = FALSE;
   } else { $fn2 = TRUE;}
   	$valid = $valid && $fn2;

This is the kind of stuff that's coming through on the hacked emails (my domain name has been REMOVED, but all were using my domain name)

Customers Name:  
Customers Email: hjek@REMOVED.com
Customers Phone: 
Page Information requested: hjek@REMOVED.com
Content-Type: multipart/mixed; boundary="===============1615891411=="
MIME-Version: 1.0
Subject: 5327f41
To: hjek@REMOVED.com
bcc: mhkoch321@aol.com
From: hjek@REMOVED.com

This is a multi-part message in MIME format.

--===============1615891411==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit

lzyklor
--===============1615891411==--
Information requested: 
Customers Address:

The Bcc email addy seems to be consistant for all who have had this happen to their forms, so either the hacker is a little stupid, or some poor bastard is getting alot of spam.

Any suggestions, on both turning the above example into a good function, which will check all possible combinations of upper and lowercase etc, or any ideas on how else to combat this.

Plus I guess this is a heads up to anyone else who uses form to email on their website.

----------------------------------------
Sometimes, when my code just won't behave, I take it outside and make it listen to britney spears music, and when it comes back it's really well behaved. I wonder if it's suffering from post tramatic stress syndrome now..

 

[kenrbnsn]

Thanks for the post. I was just getting ready add checks like this to my forms, since some of my email forms have been getting hit lately.

I was going to check for the string "Content-Type: multipart/mixed" and reject any input where it was found.

Ken

 

[WoodyRoundUp]

Thanks for the post as well.

I got this a couple of times now.
What I did was actually block the IP.
And they never return anymore.

Hopefully this will keep them away forever.

 

[kenrbnsn]

Take a look at <

http://www.phpfreaks.com/forums/index.php?showtopic=66987&st=0&p=272101&#entry272101>

It shows some code that should keep these folks at bay.

Ken

 

[DaRNCaT]

Cheers Ken, mucho appreciated!

----------------------------------------
Sometimes, when my code just won't behave, I take it outside and make it listen to britney spears music, and when it comes back it's really well behaved. I wonder if it's suffering from post tramatic stress syndrome now..

 

[DaRNCaT]

I've now added this to my email checking (as well as the hack checking function on all other input feilds), works a treat.

$email =str_replace(array("\r", "\n", "%OA", "%oa", "%OD", "%od", "Content-Type:"), "", $email);

----------------------------------------
Sometimes, when my code just won't behave, I take it outside and make it listen to britney spears music, and when it comes back it's really well behaved. I wonder if it's suffering from post tramatic stress syndrome now..

 

[kenrbnsn]

Thanks for the simple code. Have a star on me...

Ken

 

[WoodyRoundUp]

A star from me for both of you.