Hello,
please have a look at this.. if there is any problem in this ??
its send out SPAM... how to make it SPAM free ?


$mailer = new PHPMailer();
$mailer->IsSMTP();
$mailer->Host = 'ssl://smtp.gmail.com:465';
$mailer->SMTPAuth = TRUE;
$mailer->Username = 'XXXX@googlemail.com'; // Change this to your gmail adress
$mailer->Password = 'XXXX'; // Change this to your gmail password
$mailer->From = "$_POST['fromemail']"; // This HAVE TO be your gmail adress
$mailer->FromName = "$_POST['name']"; // This is the from name in the email, you can put anything you like here
$mailer->AddReplyTo("$_POST['fromemail']");
$mailer->Body = "$_POST['msg']";
//$mailer->IsHTML(true); // send as HTML
$mailer->Subject = "$_POST['subject']";
$mailer->AddAddress($invite_email); // This is where you put the email adress of the person you want to mail
if(!$mailer->Send())
{
echo "<br>Message was not sent<br/ >";
echo "Mailer Error: " . $mailer->ErrorInfo;
}
else
{
echo "Message has been sent";
}

You want to send out spam? or are you trying to stop that script from doing so in the future?

$mailer->From = "$_POST['fromemail']"; // This HAVE TO be your gmail adress
$mailer->FromName = "$_POST['name']"; // This is the from name in the email, you can put anything you like here
$mailer->AddReplyTo("$_POST['fromemail']");
$mailer->Subject = "$_POST['subject']";
$mailer->AddAddress($invite_email); // This is where you put the email adress of the person you want to mail


The problem is, you're trusting the input from the browser. :)

Try adding this (plus modifications to check whatever sets $invoice_email )

$arr = array('fromemail', 'name', 'subject');
foreach($arr as $idx)
{
list($fixed_value, $junk) = explode("\n", $_POST[$idx], 2);
$_POST[$idx] = $fixed_value;
}


What is likely happening, is in Name, FromEmail or Subject, you expect:

"Name"

or

"from@email.com"

or

"my subject"


But! The spammers use:

"Name

spam spamity spam spam"

or

"from@email.com

spam spamity spam spam"

or

"Subject

spam spamity spam spam"


the blank line in there makes the email server think the content has started.

They can also add headers, like:

"Subject
BCC: email@1.com, email@3.com

spam spamity spam spam"

Never trust the user. :D