I was thinking of something along the lines of this: error = 0; if (substr_count($_POST['from'],"\r")>0 || substr_count($_POST['from'],"\n")>0) { $error = 1; } Repeat for other variables to check Then add a switch before the last elseif: elseif ($error) { echo "<h4>Error Text.</h4>"; echo "<h4>Click here to return</h4>"; } Michael J

Laler - Using 4.4.0 Michael - Thanks, will give that a try, do you think iut would be good to also add what I suggested ie the checking for bcc and cc? Ian Venta Sanlucar Sales

hm, the version installed in my hosting company is even lower than that :| I put interest on this problem as I've beed a victim of those spammer's before. My account got suspended because my hosting company's datacenter threatened them to stop spam or they'll pull the plug out from their server, while the spam came from my account, from an exploitable script :D (a free CMS). Not to mention my domain name might be blacklisted everywhere. So in this PHP mail() problem, I then tried copy pasting the code from that page, but still I'm unable to exploit the script. The script won't send the e-mail. Maybe my hosting company put some protection module or maybe there're some php.ini settings to prevent those? I'm not sure. Anyways, you'd better do Michael J's method or the method in that website. Because if you only put Bcc and Cc then (according to the page) I guess someone will still be able to send the emails to more people by adding more Bcc/Cc. --- Site of the Day

Sorry, ::::: I was thinking of adding headers for bcc and cc and then doing something like if bcc or cc is not empty then die and setting both bcc and cc to '' i.e. nothing. ::::: That might work, but still I think checking for malicious chars (like "\") would be better. Also, an email address contains "bcc" might exist, while no email address will contain "\r" or "%0A". Btw, I'm still confused/worried am I vulnerable or not? If someone has an explanation, then please :) --- Site of the Day

This tells you a bit more. http://anders.com/cms/75/Crack.Attempt/Spam.Relay Yes your host may have disabled something, but I'm not sure you are 100% safe, you could ask your host if they did and then post back, so i could change the same setting in the php.ini The %0A where can I find a site with other character set code like this I need to add more error checking for terms like ; , in the email fields. Venta Sanlucar Sales

Have managed to cut out most if not all of the characters i want from an entry in the form, the code I used can be seen on the following thread: http://www.computing.net/programming/wwwboard/forum/13265.html Regards Ian Venta Sanlucar Sales

I am having same problems but I am a complete novice! Here is my simple script: <? $to = ""; // E-mail address to send mail to. $subject = ""; //Subject of the e-mail $message = " "; // Message shown at other end (the e-mail). mail($to, $subject, stripslashes($message), "From: $name <$email>\nX-Mailer: PHP/" . phpversion()); header( "location: " ); //url to re-direct to after mail has been succesfully sent. ?> I get all my forms sent to me filled with an email address in every field and I can receive this sometimes 20 times over and it is driving me bananas!

Your header( "location: " ); just keeps repeating the script - try something like header("location:newpage.php"); to get that working webgurl.