Question

I’ve finally got this PHP email script working (didn’t work on localhost…), but my concern is that it’s not safe.

So – is this safe for spamming and any other security pitfalls I’m not aware of?

<?php
$email = '[e-mail]';
$subject = 'Notify about stuff';
$notify = $_REQUEST['email'];

if (!preg_match("/\w+([-+.]\w+)*@\w+([-.]\w+)*\.\w+([-.]\w+)*/", $notify)) {
    echo "<h4>Your email address doesn't validate, please check that you typed it correct.</h4>";
    echo "<a href='javascript:history.back(1);'>Back</a>";
}

elseif(mail($email, $subject, $notify)) {
    echo "<h4>Thank you, you will be notified.</h4>";
} else {
    echo "<h4>Sorry, your email didn't get registered.</h4>";
}
?>

Unrelated: is there a PHP function I can use instead of javascript:history.back(1) ?

Edit: the script using filter instead of RegEx

<?php
$email = '[e-mail]';
$subject = 'Notify about stuff';
$notify = $_REQUEST['email'];

if (!filter_var($notify, FILTER_VALIDATE_EMAIL)) {
    echo "<h4>This email address ($notify) is not considered valid, please check that you typed it correct.</h4>";
    echo "<a href='javascript:history.back(1);'>Back</a>";
}

elseif(mail($email, $subject, $notify)) {
    echo "<h4>Thank you, you will be notified.</h4>";
} else {
    echo "<h4>Sorry, your email didn't get registered.</h4>";
}
?>

Answer 1

I don’t know if id use $_SERVER['HTTP_REFERER'] to go back. I feel like that could leave you open to attack since it’s set via the request. The way to do it would be to use sessions on the previous page. This way you’re not dumping untrustworthy data onto your site.

I dont see any security risks, but id like to suggest the use of filter when checking the validity of emails. its much easier than messing with REs.