| 
        php.net | support | documentation | report a bug | advanced search | search howto | statistics | random bug | login | 
  [2009-06-20 17:49 UTC] shahar dot e at zend dot com
 Description:
------------
It is very possible for a developer to use code like in the attached reproduction code to send an e-mail. However, when mail.add_x_header is On, using this code will cause the X-PHP-Originating-Script to show in the message body instead of as a header. 
This is because mail() assumes the $headers parameter is a string which does not end with a trailing CRLF - while in practice it very well may be (it works well when mail.add_x_header is Off). 
Reproduce code:
---------------
<?php
$headers = array(
	'X-Foo' => 'bar',
	'From' => 'some-guy@example.com',
	'Priority' => 'Urgent'
);
$hdrStr = '';
foreach($headers as $k => $v) {
	$hdrStr .= "$k: $v\r\n";
}
mail('someone-else@example.com', 
     'Testing add_x_header', 
     'This is a test', 
     $hdrStr);
Expected result:
----------------
Mail to look like:
                                                                                                                                                                                                                                                               
To: someone-else@example.com
Subject: Testing add_x_header
X-Foo: bar
From: some-guy@example.com
Priority: Urgent
Date: Sat, 20 Jun 2009 20:37:34 +0300 (IDT)
X-PHP-Originating-Script: 503:mailtest.php
This is a test
Actual result:
--------------
To: someone-else@example.com
Subject: Testing add_x_header
X-Foo: bar
From: some-guy@example.com
Priority: Urgent
Date: Sat, 20 Jun 2009 20:37:34 +0300 (IDT)
X-PHP-Originating-Script: 503:mailtest.php
This is a test
* this is how I receive the e-mail in GMail - perhaps there is some header mangling but you get the point
PatchesPull RequestsHistoryAllCommentsChangesGit/SVN commits             
             | 
    |||||||||||||||||||||||||||
            
                 
                Copyright © 2001-2025 The PHP GroupAll rights reserved.  | 
        Last updated: Tue Nov 04 14:00:01 2025 UTC | 
I used this patch to fix it (not sure if it's the most suitable way): --- ext/standard/mail.c.orig 2009-06-20 22:25:10.000000000 +0300 +++ ext/standard/mail.c 2009-06-20 22:29:52.000000000 +0300 @@ -241,7 +241,10 @@ php_basename(tmp, strlen(tmp), NULL, 0,&f, &f_len TSRMLS_CC); if (headers != NULL) { - spprintf(&hdr, 0, "%s\r\nX-PHP-Originating-Script: %ld:%s\n", headers, php_getuid(), f); + spprintf(&hdr, 0, "%s%sX-PHP-Originating-Script: %ld:%s\n", + headers, + (headers[strlen(headers) - 1] == '\n' ? "" : "\r\n"), + php_getuid(), f); } else { spprintf(&hdr, 0, "X-PHP-Originating-Script: %ld:%s\n", php_getuid(), f); }