LXI. Poczta elektroniczna

Wstęp

Funkcja mail() umożliwia wysyłanie e-maili.

Wymagania

Do zbudowania tego rozszerzenia nie są wymagane żadne zewnętrzne biblioteki.

Instalacja

By używać tych funkcji, nie trzeba niczego instalować. Są one częścią jądra PHP.

Konfiguracja czasu wykonywania

Na działanie tych funcji wpływają ustawienia zawarte w pliku php.ini.

Tabela 1. Mail configuration options

Name	Default	Changeable	Changelog
SMTP	"localhost"	PHP_INI_ALL
smtp_port	"25"	PHP_INI_ALL	Available since PHP 4.3.0.
sendmail_from	NULL	PHP_INI_ALL
sendmail_path	NULL	PHP_INI_SYSTEM

Szczegóły i definicje dotyczące stałych PHP_INI_* znajdują się w rozdziale Dodatek H.

Oto krótkie wyjaśnienie dyrektyw konfiguracji.

SMTP string

Used under Windows only: DNS name or IP address of the SMTP server PHP should use for mail sent with the mail() function.

smtp_port int

Used under Windows only: Number of the port to connect to the server specified with the SMTP setting when sending mail with mail(); defaults to 25. Only available since PHP 4.3.0.

sendmail_from string

Which "From:" mail address should be used in mail sent from PHP under Windows.

sendmail_path string

Where the sendmail program can be found, usually /usr/sbin/sendmail or /usr/lib/sendmail. configure does an honest attempt of locating this one for you and set a default, but if it fails, you can set it here.

Systems not using sendmail should set this directive to the sendmail wrapper/replacement their mail system offers, if any. For example, Qmail users can normally set it to /var/qmail/bin/sendmail or /var/qmail/bin/qmail-inject.

qmail-inject does not require any option to process mail correctly.

This directive works also under Windows. If set, smtp, smtp_port and sendmail_from are ignored and the specified command is executed.

Typy zasobów

To rozszerzenie nie posiada żadnych rodzajów zasobów.

Stałe predefinopwane

To rozszerzenie nie posiada żadnych stałych.

Spis treści
ezmlm_hash -- Oblicza wartość hash potrzebną dla EZMLM
mail -- Wysyła e-maila

User Contributed Notes


Note that there is a big difference between the behavior of this function on Windows systems vs. UNIX systems. On Windows it delivers directly to an SMTP server, while on a UNIX system it uses a local command to hand off to the system's own MTA.



The upshot of all this is that on a Windows system your  message and headers must use the standard line endings \r\n as prescribed by the email specs. On a UNIX system the MTA's "sendmail" interface assumes that recieved data will use UNIX line endings and will turn any \n to \r\n, so you must supply only \n to mail() on a UNIX system to avoid the MTA hypercorrecting to \r\r\n.



If you use plain old \n on a Windows system, some MTAs will get a little upset. qmail in particular will refuse outright to accept any message that has a lonely \n without an accompanying \r.


I spent hours searching the web trying to figure out why I was getting a "WARNING: mail(): SMTP server response: 501 5.5.4 Invalid Address " every time I was using the mail() function on my server (Win2K3,IIS 6.0,PHP4.4.1).  I knew everything was setup properly for SMTP based on other non IIS 6.0 configurations.



Turns out that the IIS 6.0 SMTP service does not like formatting of the "From" field in mail headers.  For instance:

<?PHP

   //This line DOES NOT send  mail message correctly

   $headers .= "From: \"".$fromname."\" <".$fromaddress.">\n";

?> 

However this works:

<?PHP

   //This line sends mail message correctly

   $headers .= "From: \"".$fromaddress."\"\n";

?>



The fix is in Microsoft Article ID 291828 ( http://support.microsoft.com/?id=291828 ).  Even though the "bug" workaround is for IIS 6.0 on Exchange 2003 communicating with a UNIX server, THIS SOLVES THE PROBLEM.  Just skip down to the last section for Exchange 2003 and follow the instructions to modify the IIS 6 MetaBase with the MetaBase Explorer found in the IIS 6 Resource Kit.


Another modest attempt at tackling those pesky mailheader injections. Works quite well for me as it is, but i would appreciate any suggestions to improve it:





<?php





    /* name: input_check_mailinj()


     * sample usage: foreach($_POST as $value) input_check_mailinj($value);


     */





function input_check_mailinj($value)


{


    # mail adress(ess) for reports...


    $report_to = "abuse@yourdomain.com";





    # array holding strings to check...


    $suspicious_str = array


    (


        "content-type:"


        ,"charset="


        ,"mime-version:"


        ,"multipart/mixed"


        ,"bcc:"


    );





    // remove added slashes from $value...


    $value = stripslashes($value);





    foreach($suspicious_str as $suspect)


    {


        # checks if $value contains $suspect...


        if(eregi($suspect, strtolower($value)))


        {


            // replace this with your own get_ip function...


            $ip = (empty($_SERVER['REMOTE_ADDR'])) ? 'empty' 


                : $_SERVER['REMOTE_ADDR']; 


            $rf = (empty($_SERVER['HTTP_REFERER'])) ? 'empty'


                : $_SERVER['HTTP_REFERER'];


            $ua = (empty($_SERVER['HTTP_USER_AGENT'])) ? 'empty'


                : $_SERVER['HTTP_USER_AGENT'];


            $ru = (empty($_SERVER['REQUEST_URI'])) ? 'empty'


                : $_SERVER['REQUEST_URI'];


            $rm = (empty($_SERVER['REQUEST_METHOD'])) ? 'empty'


                : $_SERVER['REQUEST_METHOD'];





            # if so, file a report...


            if(isset($report_to) && !empty($report_to))


            {


                @mail


                (


                     $report_to


                    ,"[ABUSE] mailinjection @ " . 


                    $_SERVER['HTTP_HOST'] . " by " . $ip


                    ,"Stopped possible mail-injection @ " . 


                    $_SERVER['HTTP_HOST'] . " by " . $ip . 


                    " (" . date('d/m/Y H:i:s') . ")\r\n\r\n" .


                     "*** IP/HOST\r\n" . $ip . "\r\n\r\n" .


                     "*** USER AGENT\r\n" . $ua . "\r\n\r\n" .


                     "*** REFERER\r\n" . $rf . "\r\n\r\n" .


                     "*** REQUEST URI\r\n" . $ru . "\r\n\r\n" .


                     "*** REQUEST METHOD\r\n" . $rm . "\r\n\r\n" .


                     "*** SUSPECT\r\n--\r\n" . $value . "\r\n--"


                );


            }





            # ... and kill the script.


            die


            (


                'Script processing cancelled: string


                (`<em>'.$value.'</em>`) contains text portions that


                are potentially harmful to this server. <em>Your input


                has not been sent!</em> Please use your browser\'s 


                `back`-button to return to the previous page and try


                rephrasing your input.</p>'


            );


        }


    }


}





?>


<?

// if you have a problem same spam enginie or hotmail use these

// sample headers.( mail your friends, maili you.)

    $headers="";

    $headers .= "X-Sender:  $mail <$mail>\n"; // 

    $headers .="From: $maili <$maili>\n";

    $headers .= "Reply-To: $maili <$maili>\n";

    $headers .= "Date: ".date("r")."\n";

    $headers .= "Message-ID: <".date("YmdHis")."selman@".$_SERVER['SERVER_NAME'].">\n";

    $headers .= "Subject: $subject\n"; // subject write here

    $headers .= "Return-Path: $maili <$maili>\n";

    $headers .= "Delivered-to: $maili <$maili>\n";

    $headers .= "MIME-Version: 1.0\n";

    $headers .= "Content-type: text/html;charset=ISO-8859-9\n";

    $headers .= "X-Priority: 1\n";

    $headers .= "Importance: High\n";

    $headers .= "X-MSMail-Priority: High\n";

    $headers .= "X-Mailer: SelmanD Mailler With PHP!\n";



?>


as to fred's posting, I had to change the code a bit:

-add a hashbang

-add "-t -i " to the sendmail call



great idea though.



#!/usr/bin/php

<?php



       $tmpfile = "/tmp/" . uniqid('') . ".mail";



       $fp = fopen($tmpfile,"w");



       fwrite($fp,"x-wls-cc-filter: On\n");

       while($line = fgets(STDIN))

       {

               $line = ereg_replace("^bcc:","x-wlsspam-bcc:",$line);

               $line = ereg_replace("^cc:","x-wlsspam-cc:",$line);

               fwrite($fp,$line);

       }

       fclose($fp);



       $cmd = '/usr/sbin/sendmail -t -i ';

       for($i = 1 ; $i < $argc; $i++)

       {

               $cmd .= $argv[$i];

               $cmd .= ' ';

       }

       $cmd .= "<$tmpfile";

       system($cmd);

?>


I just thought this would be useful for someone.



It's one thing to write your mail forms so they don't support spam via header injection. It's quite another to run a hosting operation with hundreds of web sites that are controlled by different webmasters and customers that do not want to pay to have thier sites fixed. In fact it's very difficult to identify all the buggy sites. As a result, I came up with this little sendmail wrapper. I made this as a cli script and used it as a replacement for sendmail in the php.ini file. Since our web servers have no reason to send BCC and CC Header, this script renames them so they don't work. 



You would also need to write a script to clean up the temporary files. This script could save messages that were spamming attempts so you can study them later. It would just look for the replacement headers to determine if it was a spamming attempt.



<?php



        $tmpfile = "/tmp/" . uniqid('') . ".mail";



        $fp = fopen($tmpfile,"w");



        fwrite($fp,"x-wls-cc-filter: On\n");

        while($line = fgets(STDIN))

        {

                $line = ereg_replace("^bcc:","x-wlsspam-bcc:",$line);

                $line = ereg_replace("^cc:","x-wlsspam-cc:",$line);

                fwrite($fp,$line);

        }

        fclose($fp);



        $cmd = '/usr/sbin/sendmail ';

        for($i = 1 ; $i < $argc; $i++)

        {

                $cmd .= $argv[$i];

                $cmd .= ' ';

        }

        $cmd .= "<$tmpfile";

        system($cmd);

?>


I too have had someone trying to use my site to send spam email by injecting headers and using a bcc: address. One way to stop this is by creating a multipart message as shown in the code below.



Note that to pass the 'antispam' checks of hotmail etc. you should set up automailer@mysite.com as a "real" email account, so that if anyone checks it'll actually be there.



<?php



// YOU CAN SET THESE ALL UP YOURSELF



DEFINE("NAME","MySite");

DEFINE("RETURN_ADDRESS","automailer@mysite.com");



$contactemail="personToContact@their-email.com";

$contactname="Person to Contact";



$subject="The subject";

$messageNotHTML="This is the message in text format";



// THE MAIN FUNCTIONALITY



$boundary = md5(time().rand(1,100));



$headers = "MIME-Version: 1.0

Content-Type: multipart/alternative; boundary=\\"{$boundary}"

X-Mailer: PHPmailer

From: \\"".NAME."" <".RETURN_ADDRESS.">

";



$message = "

--{$boundary}

Content-Type: text/plain; charset=ISO-8859-1

Content-Transfer-Encoding: quoted-printable



$messageNotHTML



--{$boundary}--



";



$didmail = mail("\\"".$contactname."" <".$contactemail.">", $subject, $message, $headers);

?>


Send an e-mail directly to client smtp server in real time.

For more informations, please visit : http://expert.no-ip.org/?free=smtp_mail&func



<?php



@set_time_limit(0);

 

require_once 'smtp_mail.php';

 

$to = "expertphp@yahoo.com";

$from = "from@myaccount.com";

$subject = "Subject here";

 

$headers = "MIME-Version: 1.0\r\n".

    "Content-type: text/html; charset=iso-8859-1\r\n".

    "From: \"My Name\" <".$from.">\r\n".

    "To: \"Client\" <".$to.">\r\n".

    "Date: ".date("r")."\r\n".

    "Subject: ".$subject."\r\n";

 

$message = "

<html>

<body>

<b>html message</b><br>

<font color=\"red\">here</font>

<img src=\"http://static.php.net/www.php.net/images/php.gif\" 

border=\"0\" alt=\"\">

</body>

</html>

";



$response = smtp_mail($to, $subject, $message, $from, $headers);

 

if($response[0]) echo "The message has been sent !<br />\n".$response[1];

else echo "The message can not been sent !<br />\n".$response[1];

 

?>


Problems with Microsoft Exchange and PHP as ISAPI-module



We found out, that if you want to send multipart mime emails using the PHP mail-function on a Windows box using a Microsoft Exchange server, you have to use separate containers for the mail body and the mail header.



In many examples like in http://www.zend.com/zend/trick/html-email.php or in the book PHP developers cookbook you find html multipart/alternative mailing solutions that build the mime header and the mail body into one PHP variable and send this as fourth argument (header) to the PHP mail-function. This works fine on most systems but not on the above mentioned combination.



We found a rather trivial solution: Simply split the mime mail header and the mail body into two separate variables and give them separately to the PHP mail function, example:



<?php

//add From: header

$headers = "From: webserver@localhost\r\n";



//specify MIME version 1.0

$headers .= "MIME-Version: 1.0\r\n";



//unique boundary

$boundary = uniqid("HTMLDEMO");



//tell e-mail client this e-mail contains//alternate versions

$headers .= "Content-Type: multipart/mixed; boundary = $boundary\r\n\r\n";



//plain text version of message

$body = "--$boundary\r\n" .

   "Content-Type: text/plain; charset=ISO-8859-1\r\n" .

   "Content-Transfer-Encoding: base64\r\n\r\n";

$body .= chunk_split(base64_encode("This is the plain text version!"));



//HTML version of message

$body .= "--$boundary\r\n" .

   "Content-Type: text/html; charset=ISO-8859-1\r\n" .

   "Content-Transfer-Encoding: base64\r\n\r\n";

$body .= chunk_split(base64_encode("This the <b>HTML</b> version!"));



//send message

mail("root@localhost", "An HTML Message", $body, $headers);

?>


Last night we had a spammer use our form-to-mail system to send spam. I had protected the 'to' field in the function so I couldn't understand how they were using it to send to other people.



So, I added tracking information to anyone who posts to the form and they tried again this morning. This is what I found out.  They were posting a message within a message.



In all the variables sent with the form they had this (they were using another program to post directly to the form):



vltrwe@domain.com

Content-Type: multipart/mixed; boundary="===============1998658368=="

MIME-Version: 1.0

Subject: 9c954098

To: victim@domain.com

bcc: victim@domain2.com

From: vltrwe@domain.com



This is a multi-part message in MIME format.



--===============1998658368==

Content-Type: text/plain; charset="us-ascii"

MIME-Version: 1.0

Content-Transfer-Encoding: 7bit



SPAM MESSAGE HERE.

--===============1998658368==--



So, the system, when passed this information in the header of the e-mail thought it was the continuation of the format and it sent the additional email data and thus spam goes out.  Clear as mud?



I have never seen such a clever, if you will, hacking tool.  This is downright devious. Protect ANY variables being sent to ANY function. I am looking for "Content-Type:" since I am sure this is the only way to do this. If it's not, I'll know about it because my tracking data is still there.


hi all programmer


this code is a simple code for attachment mail for use whitout class





<?php


$type = array('gif'  => 'image/gif',


                        'jpg'  => 'image/jpeg',


                        'jpeg' => 'image/jpeg',


                        'jpe'  => 'image/jpeg',


                        'bmp'  => 'image/bmp',


                        'png'  => 'image/png',


                        'tif'  => 'image/tiff',


                        'tiff' => 'image/tiff',


                        'swf'  => 'application/x-shockwave-flash',


                        'doc'  => 'application/x-msword',


                        'xls'  => 'application/x-msexel',


                    'bilinmiyor'  => '"application/x-unknown-content-type"');


$header="";


$message="";


$boundary='--' . md5( uniqid("myboundary") );


$priorities = array( '1 (Highest)', '2 (High)', '3 (Normal)', '4 (Low)', '5 (Lowest)' );


$priority=$priorities[3];


$charset="iso-8859-9";


$ctencoding="8bit";


$subject="merhaba";


$body="merhaba arkada