Tagged Questions

6
votes
5answers
2k views

Email forgotten password or send reset link, both just as insecure?

I originally posted this as a reply here in this thread but didn't get much feedback on it, and now I'm curious as to what others think is the best approach, or if there is any difference between the ...
6
votes
3answers
863 views

PHP mail() Header Injection Prevention

This site nicely explains the problem. Essentially, nearly all php mail() examples that are given are vulnerable to header injection attacks. The referenced site gives a regex sanitation solution ...