Description:
------------
Most of PHP users are unaware of security implications of such "Send 
to friend" scripts:
<?
  mail($_POST['send_to_friend'],$_POST['subject'],$_POST['message']);
?>

I propose change of parameters to mail(): 
mail(array $to, string $subject, string $message[, array 
$additional_headers [, string $additional_parameters ]] );

The function should throw a warning if there is a newline anywhere, 
even inside arrays, and should not process the mail. 

I agree that the programmer should know its tools, BUT:
- the fact is that most of PHP users don't
- most of the TUTORIALS are insecure! A quick search for "PHP mail 
example" reveals many prominent pages with such examples. 

This is a huge problem and spammers are abusing it extensively.

As this will undoubtedly break some of the scripts (though the fix 
should be easy) I suggest adding a configuration statement that 
enables such mail() behaviour,

Reproduce code:
---------------
<?
  // $POST['send_to_friend'] == "me@example.com\r\n"."
  //                            "BCC: you@example.com";
  mail($_POST['send_to_friend'],$_POST['subject'],$_POST['message']);
?>

Expected result:
----------------
Warning: newline in mail() function, line... 
Mail not sent or everything after newline ignored.

Actual result:
--------------
Mail sent to me@example.com and to you@example.com.