I am running PHP as CGI on IIS 5.0 with service pack 2.  

This report verifies that bug #11349 is a definate problem.
/win32/sendmail.c has the following code (starting at line 253):

/* Send mail to all Cc rcpt's */
efree(tempMailTo);
if (headers && (pos1 = strstr(headers, "Cc:"))) {
	pos2 = strstr(pos1, "\r\n");
	tempMailTo = estrndup(pos1, pos2-pos1);

	token = strtok(tempMailTo, ",");
	while(token != NULL)
	{
		sprintf(Buffer, "RCPT TO:<%s>\r\n", token);
		if ((res = Post(Buffer)) != SUCCESS)
			return (res);
		if ((res = Ack()) != SUCCESS)
			return (res);
		token = strtok(NULL, ",");
	}
	efree(tempMailTo);
}

The above code can only grab an email address that looks like this: 

Cc: jack@smith.com

When I place it in this format I receive a "Warning:  Server Error" message from the mail() function.

sendmail.c cannot find a proper RFC 822 mail header like:

Cc: Jack Smith <jack@smith.com>

When I place this in the mail headers nothing happens.

Also, there is no code at all that even looks for a Bcc address in the sendmail.c code.  This is a massive problem.

In order for the mail() function to be /usr/sbin/sendmail compliant it must be able to find and parse Cc: and Bcc: in each of the above formats. It must also remove the Bcc's from the header so that recieving mail clients cannot see them, just as sendmail does.

Brent