Email Header Injection

Also Known As

TL;DR

Explanation

PHP's mail() function constructs raw SMTP headers. If user-supplied data (a name or subject) contains \r\n, an attacker can inject additional headers — Bcc:, Cc:, or a new message body — turning the server into a spam relay. Always strip newlines from any value passed to mail() headers. Better still, use a dedicated library such as Symfony Mailer or PHPMailer which sanitise headers automatically, and validate email addresses with filter_var($addr, FILTER_VALIDATE_EMAIL).

Common Misconception

Why It Matters

Common Mistakes

• Passing user-supplied email addresses directly to the headers parameter of PHP's mail() function.
• Not stripping newline characters from email addresses or subject lines before using them in headers.
• Building header strings manually via concatenation instead of using a library like PHPMailer or Symfony Mailer.
• Forgetting that Subject is also injectable — newlines in the subject can inject additional headers.

Code Examples

mail($to, $_POST['subject'], $body); // subject may contain \r\nBcc: attacker@evil.com

$subject = str_replace(["\r", "\n"], '', $_POST['subject']);
mail($to, $subject, $body);

References

• ↗ https://owasp.org/www-community/attacks/Email_Header_Injection

Tags

Related Terms