从PHP安全发送电子邮件

Question

I've got a page on my website where users can send me a message by giving their email, name, and a message. On the front end (JS) I do some basic verification, make sure the email is formatted like an email, make sure the other boxes aren't blank, and then I send it to PHP by GET.

Now I'm aware people can do some pretty sneaky stuff by injecting malicious code into PHP. What precautions should I be taking? When I was working with MySQL, I would escape it using the mysqli escape function. What should I be doing here?

Here's my script right now:

<?php
    if(!isset($_GET["message"]) || !isset($_GET["name"]) || !isset($_GET["email"])){
        echo "Check all the fields are correctly filled in and try again!";
        die();
    }
    $email = $_GET["email"];
    $message = $_GET["message"];
    $name = $_GET["name"];
    if($email == ""|| $message == "" || $name == ""){
        echo "Check all the fields are correctly filled in and try again!";
        die();
    }

    $message = wordwrap($message, 70);

    mail("email@email.com","A Message From " . $name,$message,"From: $email\n");
    echo "success";
?>

Answer 1

一种非常基本的方法是，您可以声明一个变量（例如$pattern ）并在其中存储正则表达式（例如攻击中常用的模式），然后使用preg_match($pattern, $valueFromYourForm)方法查看是否有任何传递的值与任何这些表达式匹配，然后您可以停止执行。