CFLib.org – Common Function Library Project

Description:
Clean variables, such as form input, to modify values that may have been entered to perform e-mail injection. This includes 'content-type','mime-version','to','bcc' and 'subject'. It keeps the value intact, but replaces colons to avoid injection. Credit to: http://www.webmasterworld.com/forum10/9776-2-10.htm E-mail injection: http://en.wikipedia.org/wiki/Email_Injection

Return Values:
Returns a string.

Example:

<cfset mailTo = "test@domain.com">
<cfset mailBody = "test injection#CHR(10)#Content-type: text/plain#CHR(10)#">

<cfset cleanMailBody = trimFalseEmailHeaders(mailBody )>

Parameters:

Full UDF Source:

<cfscript>
/**
 * Clean variables, such as form input, to modify values that may have been entered to perform e-mail injection.
 * 
 * @param str 	 String to parse. (Required)
 * @return Returns a string. 
 * @author Tony Brandner (&#116;&#111;&#110;&#121;&#64;&#98;&#114;&#97;&#110;&#100;&#110;&#101;&#114;&#115;&#46;&#99;&#111;&#109;) 
 * @version 1, February 3, 2006 
 */
function trimFalseEmailHeaders(str) {
	str = replaceNoCase(str, "Content-Type:", "content-type;", "ALL" );
	str = replaceNoCase(str, "MIME-Version:", "mime-version;", "ALL" );
	str = replaceNoCase(str, "To: ", "to; ", "ALL" );
	str = replaceNoCase(str, "From: ", "from; ", "ALL" );
	str = replaceNoCase(str, "bcc: ", "bcc; ", "ALL" );
	str = replaceNoCase(str, "Subject: ", "subject; ", "ALL" );
	return str;
}
</cfscript>