CODEWITHSUNDEEP
phpsecurity
Timothée HENRY
Timothée HENRY

Reputation: 14604

How to secure the use of a PHP script that triggers emails?

I build a PHP script to send emails (based on Amazon SES).

So I can make a GET or POST Ajax call to my PHP script:

envoi.php?nom=John&[email protected]

triggers an email to be sent to [email protected].

My website has a registration form which on submit makes a jquery ajax call to the PHP script (website and PHP script are on the same server). I use the script also for other events.

Now I am concerned that this script could obviously be abused if anyone gets hold of its URL.

How can I secure the access to this script?

Upvotes: 5

Views: 404

Answers (3)

Anirudh Ramanathan
Anirudh Ramanathan

Reputation: 46728

Step1: When the user opens the registration form, from which he can send mail and passes captcha, set a $_SESSION parameter.

$_SESSION["mail_allowed"] = true;

Step2: The request is sent as usual to

envoi.php?nom=John&[email protected]

Step3: Finally, in the mail script, do something like the following:

if($_SESSION["mail_allowed"]){
    $_SESSION["mail_allowed"] = false;
    //send mail  
}
else{
    die('File cannot be executed directly');
}

This way, the user is allowed to send mail once he opens your page, but cannot execute the mailer script directly.

Upvotes: 3

Explosion Pills
Explosion Pills

Reputation: 191729

Yes, this could easily be abused. There's no solid solution, but a couple ways to protect it come to mind:

  • Only allow the link to work for authenticated users that you are sure aren't bots (captcha?)
  • Prevent the same IP address from issuing repeated requests.

Upvotes: 1

Darin Dimitrov
Darin Dimitrov

Reputation: 1038710

You could use a captcha to protect access to this script and make abuses a little harder.

Upvotes: 4

Related Questions