|  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #28038 Sent incorrect RCPT TO commands to SMTP server
Submitted: 2004-04-17 19:14 UTC Modified: 2009-08-19 11:30 UTC
Avg. Score:4.4 ± 0.9
Reproduced:148 of 157 (94.3%)
Same Version:72 (48.6%)
Same OS:126 (85.1%)
From: jordi at jcanals dot net Assigned: garretts (profile)
Status: Closed Package: Mail related
PHP Version: 5.*, 6SVN OS: win32 only
Private report: No CVE-ID: None
 [2004-04-17 19:14 UTC] jordi at jcanals dot net
In windows, and using an SMTP server, when you try to send a mail using the mail function the SMTP transaction will fail if you include recipient names.

When including any recipient header in the following format (wich follows the RFC 2822), the mail function does not handle it properly:

To: User Name <>
Cc: Other User <>
Bcc: Third User <>

Loking at the SMTP transaction, the PHP mail layer sends this RCPT commands wich do not folow the SMTP standard stated on RFC 2821:

RCPT TO:<User Name <>>
RCPT TO:<Other User <>>
RCPT TO:<Third User <>>

Fails always with this environments:
Tested on Windows XP, Apache 2.0.49, PHP 4.3.6 (Also in 4.3.4)
Tested also on Windows 2000, IIS, PHP 4.3.6

Tested Using SMTP servers on Linux with Exim and Sendmail.
Tested also using the default Windows 2000 SMTP server.

Reproduce code:
// SAMPLE 1:

$to_recipient = "User Name <>";
$header = "Cc: Other User <>\r\n";
$header .= "Bcc: Third User <>\r\n";
mail($to_recipient, $subject, $body, $header);

// FAILS with SMTP errors for all three recipients.

$to_recipient = "";
$header = "To: User Name <>\r\n";
$header .= "Cc: Other User <>\r\n";
$header .= "Bcc: Third User <>\r\n";
mail($to_recipient, $subject, $body, $header);

FAILS on with SMTP error on the three recipients passed on the $header field.

Expected result:
Expected that the mail layer exctracts only the mail address from recipients to send the SMTP commands:

As seen on the RFC's 2821 and 2822, when sending a mail with the recipient headers formed like above, it is expected the mail layer to extract ONLY the email address to send the RCPT commands, and pass the headers without any change in the DATA command during the SMTP transaction. Example of the  correct SMTP transaction for the above headers:



To: User Name <>
Cc: Other User <>
Bcc: Third User <>

Actual result:
You get that error for all recipients with the recipient name:

Warning: mail(): SMTP server response: 501 <SomeOne Name <>>: "@" or "." expected after "SomeOne" in mail.class.php on line 333

This error is produced when the mail layer is sending a wrong formed RCPT TO: command in the SMTP transaction.


formulario (last revision 2010-12-01 23:42 UTC) by eli at cockteleros dot com)

Add a Patch

Pull Requests

Add a Pull Request


AllCommentsChangesGit/SVN commitsRelated reports
 [2004-08-06 01:59 UTC] papercrane at reversefold dot com
Here's a possible patch for it. It's pretty simplistic, bit it should work:

Full file:

NOTE: I haven't actually *tested* this, it may not even compile. If it doesn't, please send me a note and I'll try to fix it.
 [2005-01-25 00:26 UTC]
The above patch is wrong. Only acceptable form for RCPT TO:


Notice the brackets. Do not confuse yourself with RFC2822..
It does not obsolete 2821 as it talks about different thing.

So the fix is to drop the outside brackets stuff out of the addresses.

 [2005-11-01 11:36 UTC]
See also bug #32600 (rpath set wrong too)
 [2005-11-01 11:37 UTC]
See also bug #35013, one more way how headers are parsed wrong.
 [2005-11-02 00:05 UTC] php-louis at steelbytes dot com
can we at least just implement stripping of leading and trailing white space on what is extracted from the headers? (as that'll fix 35013).
 [2005-11-10 15:57 UTC] Ruben at e-builds dot com
The sames happens when using mail() with the 'From' part of the extra headers.

php uses this Header From part (and others for RPath etc..) for the "MAIL FROM" address in the SMTP protocol, at least if you didn't specify the sendmail_from setting in php.ini.
But for one reason or another, php (I th?nk it's php) wraps this part in "<" and ">" again!

The workaround is not to use the special format -User <xxx@yy.zzz>-, but just the e-mail address "xxx@yyy.zzz".  Of course then php scripters who like a professional approach and want to use this special format, ..well..they can't, at least not per php script.

I use a Domino SMTP server on Win32.
P.S. I saw several bugs of the same kind allover.  Some are even wrongly closed, I presume.
 [2006-01-06 03:17 UTC]
The case reported in bug #35013 should be fixed now in CVS.
(the others are NOT!)

 [2006-04-14 11:55 UTC]
See also bug #37073
 [2007-02-23 14:24 UTC] business at ziu dot de
This bug is now open since THREE YEARS. And still the version of today (5.2.1) can not talk to SMTP servers as it should do.
This can not be so complicated to fix.
 [2007-06-28 00:38 UTC]
It's propably not complicated to fix but there just isn't anyone with enough interest to do it. Feel free to provide a patch and perhaps someone might catch on it. Or pay someone serious cash to fix it..
 [2008-09-01 12:11 UTC] anon at anon dot com
Workaround is:

Set the following before calling the mail function:

ini_set('sendmail_from', ';
 [2008-12-10 18:02 UTC] webmaster at cjr3 dot com
This so-called "bug" isn't so much a bug considering you should pass the headers correctly (as you always should).

Consider the following:

Content-Type: text/html
From: Someone <someone@somewhere.tld>
Reply-To: Someone <someone@somewhere.tld>

As Windows (and other Microsoft products do) follows standards so strict that at times can aggravate developers who are used to using libraries fixing their mistakes for them, you'll need to pass proper information for it to work properly.

The "work around" shouldn't be used because you're still modifying PHP's intentions, which you shouldn't be doing unless absolutely necessary.

Furthermore, you do not have to use <Name<>> or <Name <name@whatever.there>> for it to work (in fact, this does work, but it does cut off after the first '>' and makes your name look stupid in the "from" for the email.
 [2008-12-10 19:46 UTC] jordi at jcanals dot net
You did not understand where the bug is (or was). We pass the proper headers exactly the same in any platform. PHP mail layer change them to the wrong format, by adding extra signs.

What you say we have to consider, Is what we are doing. Read carefully the bug description, the headers sent to PHP mail function, and the headers sent by the mail layer to the mail server.
 [2009-01-06 19:41 UTC] ghooey at gmail dot com
Unlike with a linux server the email address in ini_set('sendmail_from', '; has to be a valid email address
 [2009-01-12 11:49 UTC] julioworld at hotmail dot com
I also had this problem and I solved it by adding this line in the php.ini in the section [mail function]:

[mail function]
sendmail_from =
 [2009-02-24 23:25 UTC] mark at lbisat dot com
By modifying the following in PHP.ini

[mail function]
sendmail_from =

It fixed the issue for me on Windows 2003 Server SP2.
 [2009-04-06 14:29 UTC] php at shitware dot nl
I'm no C expert, but wouldn't this provide a quick fix:

instead of:

snprintf(Buffer, MAIL_BUFFER_SIZE, "RCPT TO:<%s>\r\n", token);


snprintf(Buffer, MAIL_BUFFER_SIZE, token[(strlen(token)-1)] == ">" ? "RCPT TO:%s\r\n" : "RCPT TO:<%s>\r\n", token);

for EVERY use of token (including RPath)?

(plain e-mail addresses are still placed between <...>, formatted e-mail addresses get in the transaction unaltered)

I tried setting up the Windows build environment to test this, but got lost in the different how-to's ...
 [2009-08-18 18:50 UTC]
I've fixed this in PHP-5.3.1-dev.

I added in code to use the contents between angle brackets < > if there is a pair of angle brackets passed in.

If the angle brackets are not passed in as a pair, this patch doesn't alter the contents (missing one angle bracket is clearly invalid), and should likely be rejected by the SMTP server.

And, for the record SMTP (RFC 2821) doesn't have its addresses defined by RFC 2822 for "MAIL FROM:" and "RCPT TO:" -- they should be just the undecorated mailbox address. (see RFC 2821- 4.1.2 Command Argument Syntax)

 [2009-08-18 18:58 UTC]
Automatic comment from SVN on behalf of garretts
Log: - Fixed bug #28038 (Sent incorrect RCPT TO commands to SMTP server)
 [2009-08-19 11:30 UTC]
According to the commit, this is fixed in all branches. So fix will be in upcoming 5.2.11 release as well, not only 5.3.1.
 [2009-08-26 21:59 UTC]
Automatic comment from SVN on behalf of pajoye
Log: - silent warning (fix for #28038)
 [2014-01-31 21:51 UTC] ka30r dot 2014 at gmail dot com
سلام این یه تست هستش
 [2014-02-19 02:19 UTC] van_thuat at lampart dot com dot vn
PHP Copyright © 2001-2018 The PHP Group
All rights reserved.
Last updated: Tue Sep 25 20:01:25 2018 UTC