Thread: email header injection in ClassiPress

email header injection in ClassiPress

I want to customize my "contact ad poster" email so the subject line contains the title of the ad.

For example, producing an email with a header like this, where Adam is the ad poster, Vicky is the ad visitor, and the ad title is "A cool car for sale."

I am worried someone will be able to do email header injection by having the ad title contain special characters (like, posting an ad himself, then responding to his own ad with malicious intent).

For example, if the ad title were:

Would that make the header be this?

Would the email header contain those two fields ("cc:" and "bcc:"), or would something sanitize the subject along the way (e.g. wp_mail() )? Or is it impossible for an ad title to have values that could be used in email header injection?