检查电子邮件标头注入

Posted 2021-02-26

public function InjectionSafe($TestString, $RemoveLinks = false){
		$regex = '/^to+(?=:)|^content-type:|^cc:|^bcc:|^from:|^subject:|^mime-version:|^content-transfer-encoding:/im';
 
		// Don't allow any of these strings in here
		if(0 < preg_match($regex, $TestString)){
		// Illegal characters
		return false;
		}
		else{
		 if(true === $RemoveLinks)
		 {
		  $regex2 = '/http://|https://|href=|mailto:/i';
		  if(0 < preg_match($regex2, $TestString))
			 {
		// Illegal characters
		return false;
			 }
		 }
 
		 // No nasties found, we cool
	  return true;
		}
	}