# Email Injection attacks

**URL:** <https://discuss.rubyonrails.org/t/email-injection-attacks/7723>\
**Category:** rubyonrails-talk\
**Created:** [January 24, 2007, 4:35pm UTC](https://discuss.rubyonrails.org/t/email-injection-attacks/7723 "2007-01-24T16:35:46Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Long](https://avatars.discourse-cdn.com/v4/letter/l/e47774/32.png) [@Long](https://discuss.rubyonrails.org/u/Long)\
**Post date:** [January 24, 2007, 4:35pm UTC](https://discuss.rubyonrails.org/t/email-injection-attacks/7723/1 "2007-01-24T16:35:46Z")

</div>

I wonder if it is enough to scan the message body for and replace them?

-- Long [http://MeandmyCity.com/](http://MeandmyCity.com/) - Free, searchable business directory for local communities [http://edgesoft.ca/blog/read/2](http://edgesoft.ca/blog/read/2) - No-Cookie Session Support plugin for Rails

---

<div class="post-metadata">

**Author:** ![Chris\_Hall](https://avatars.discourse-cdn.com/v4/letter/c/0ea827/32.png) [@Chris\_Hall](https://discuss.rubyonrails.org/u/Chris_Hall)\
**Post date:** [January 24, 2007, 4:59pm UTC](https://discuss.rubyonrails.org/t/email-injection-attacks/7723/2 "2007-01-24T16:59:01Z")

</div>

not just the message body. you'd have to scan the headers (to, from, subject) for anything that should'nt be there or not in the correct format.

see

[http://www.securephpwiki.com/index.php/Email\_Injection](http://www.securephpwiki.com/index.php/Email_Injection)

for a list of example scenarios.

---

<div class="post-metadata">

**Author:** ![Long](https://avatars.discourse-cdn.com/v4/letter/l/e47774/32.png) [@Long](https://discuss.rubyonrails.org/u/Long)\
**Post date:** [January 24, 2007, 5:56pm UTC](https://discuss.rubyonrails.org/t/email-injection-attacks/7723/3 "2007-01-24T17:56:22Z")

</div>

I agree. Each form field should be scanned.

-- Long

Chris Hall wrote: