The scenario I'm trying to address is this: There is a web application Y which has an authenticated user. Inside Y, web application X is hosted (which belongs to a different domain). When X is ...
I originally posted this as a reply here in this thread but didn't get much feedback on it, and now I'm curious as to what others think is the best approach, or if there is any difference between the ...
This site nicely explains the problem. Essentially, nearly all php mail() examples that are given are vulnerable to header injection attacks. The referenced site gives a regex sanitation solution ...