Internetworkers: http://www.ibiblio.org/internetworkers/

["Tony Spencer" <tony AT tonyspencer.com>]

Recipient address hidden in the form opens you up to a serious problem.
Anyone can use your form for anonymous relaying of email through your
server.  

T O N Y  S P E N C E R
Notsleepy LLC
6512 Six Forks Rd.
Suite 502-B 
Raleigh, NC 27615
Phone: 919.848.0691
Mobile: 415.637.6481
tony AT tonyspencer.com 

  

> -----Original Message-----
> From: internetworkers-bounces AT lists.ibiblio.org 
> [mailto:internetworkers-bounces AT lists.ibiblio.org] On Behalf 
> Of H. Wade Minter
> Sent: Tuesday, August 03, 2004 10:23 AM
> To: Internetworkers: http://www.ibiblio.org/internetworkers/
> Subject: Re: [internetworkers] Favorite Form Mail?
> 
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
> 
> On Tue, 3 Aug 2004, Alan MacHett wrote:
> 
> > Anyone got a recommendation for a favorite, easily-customized 
> > cgi-script for form mail?  Need I add, secure.
> 
> Just avoid anything by Matt Wright.  The NMS stuff
> (http://nms-cgi.sourceforge.net/) isn't bad.
> 
> > Related:  I'm not a scriptor/programmer, but shouldn't the 
> recipient's 
> > email address be in the script, rather than hidden in the 
> form? ... in 
> > order to avoid scrapers and other privacy issues.
> > poor example?:
> > http://help.earthlink.net/websupport/startersite/mailto.html
> 
> It's a tradeoff.  Having the address embedded in the form 
> allows you to have one script that can be used to process 
> mail from many different HTML pages.  It does open you up to 
> scraping.  The tradeoff is to have a separate CGI script or 
> config file for each form that wants to send different mail.
> 
> - --Wade
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.2.4 (FreeBSD)
> 
> iD8DBQFBD5/Co4DwsyRGDscRAjnbAKC2pPrL1E+3XlAXBgOriSPZF6U0DQCgidr9
> KHNXdcJxLz1Kuf/5uh5C2Ww=
> =/QlD
> -----END PGP SIGNATURE-----
> 
> ---
> Come and play at the InterNetWorkers Web site!  
> http://www.ibiblio.org/internetworkers/
> You are currently subscribed to InterNetWorkers mailing list 
> To unsubscribe visit 
> http://lists.ibiblio.org/mailman/listinfo/internetworkers
> 
>