search menu icon-carat-right cmu-wordmark

CERT Coordination Center

PHP fails to filter ASCII control characters from string arguments of mail() function

Vulnerability Note VU#410609

Original Release Date: 2002-09-16 | Last Revised: 2002-09-16


PHP does not properly filter parameters to its mail() function.


PHP is a scripting language widely used in web application development. PHP includes a function called mail() that takes message parameters such as recipient address and sends mail using sendmail. PHP does not filter these parameters for inappropriate characters, such as ASCII control characters. When such characters are passed to sendmail, the mail message may be altered and mail headers may be forged.

Documentation of the mail() function does not explain this risk to the developer and does not establish any responsibility on the script developer to filter message parameters before passing them to the mail() function. PHP should filter these characters or document script developers' responsibility to filter these parameters before calling mail().


Through a PHP script that passes user input to the mail() function, attackers may be able to alter message headers and content.


The CERT/CC is currently unaware of a practical solution to this problem.

Filter parameters to mail() function

In email addresses, remove any characters not explicitly valid for email addresses. In other fields, use a similar technique based on valid characters for those parameters.

Vendor Information


The PHP Group Unknown

Updated:  August 26, 2002



Vendor Statement

We have not received a statement from the vendor.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.


The CERT/CC has no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us email.

CVSS Metrics

Group Score Vector



Thanks to Wojciech Purczynski for reporting this vulnerability.

This document was written by Shawn Van Ittersum.

Other Information

CVE IDs: None
Severity Metric: 5.52
Date Public: 2002-08-23
Date First Published: 2002-09-16
Date Last Updated: 2002-09-16 23:41 UTC
Document Revision: 7

Sponsored by CISA.