<blockquote>
  <p>Does the Craft email service have any protection / validation in place to mitigate against potential Mail Header Injection attacks</p>
</blockquote>

<p>Yes.</p>

<p>Attacks like this, for the most part, are really only a concern for PHP apps that roll with their own custom email logic instead of using a widely used/tested email library.  Craft 2 uses <a href="https://github.com/PHPMailer/PHPMailer" rel="nofollow noreferrer">PHPMailer</a> and Craft 3 uses <a href="http://swiftmailer.org/" rel="nofollow noreferrer">SwiftMailer</a>.</p>

<p>And they <a href="https://github.com/PHPMailer/PHPMailer/blob/master/class.phpmailer.php#L3711-L3714" rel="nofollow noreferrer">both</a> provide <a href="http://swiftmailer.org/docs/headers.html#text-headers" rel="nofollow noreferrer">methods</a> for stripping out newlines to prevent header injection attacks.</p>

CC BY-SA 3.0
2017-06-23T09:41:03.860Z
Thanks for the response Brad. That's a very helpful description to return to our client with.
Steve Rowland
CC BY-SA 3.0
2017-06-23T05:16:54.550Z
2017-06-23T05:16:54.550Z
Brad Bell
<p>We have a client website using Sprout Forms for a contact form. The client has queried a number of security topics with us, one of which is about Mail Header Injection attack protection (<a href="https://www.acunetix.com/blog/articles/email-header-injection/" rel="nofollow noreferrer">https://www.acunetix.com/blog/articles/email-header-injection/</a>).</p>

<p>I've reached out to Ben at Barrel Strength and his response was that Sprout Forms uses the default Craft email service so any security steps Craft is taking they're piggybacking on.</p>

<p>The site is currently using the PHP Mail email setting.</p>

<p>Does the Craft email service have any protection / validation in place to mitigate against potential Mail Header Injection attacks or would we need to implement any updates to protect against this?</p>

<emails><plugin-sproutforms><security>
Is Craft's Email Service Protected Against Mail Header Injection Attacks?
# Is Craft's Email Service Protected Against Mail Header Injection Attacks?

(Asked by: username_0 on 2017-06-22)

We have a client website using Sprout Forms for a contact form. The client has queried a number of security topics with us, one of which is about Mail Header Injection attack protection (<https://www.acunetix.com/blog/articles/email-header-injection/>).

I've reached out to Ben at Barrel Strength and his response was that Sprout Forms uses the default Craft email service so any security steps Craft is taking they're piggybacking on.

The site is currently using the PHP Mail email setting.

Does the Craft email service have any protection / validation in place to mitigate against potential Mail Header Injection attacks or would we need to implement any updates to protect against this?

**Tags:** emails, plugin-sproutforms, security

---

## 1 answers

### Answer by username_1 on 2017-06-23. Score: 2 | Accepted answer

> Does the Craft email service have any protection / validation in place to mitigate against potential Mail Header Injection attacks

Yes.

Attacks like this, for the most part, are really only a concern for PHP apps that roll with their own custom email logic instead of using a widely used/tested email library. Craft 2 uses [PHPMailer](https://github.com/PHPMailer/PHPMailer) and Craft 3 uses [SwiftMailer](http://swiftmailer.org/).

And they [both](https://github.com/PHPMailer/PHPMailer/blob/master/class.phpmailer.php#L3711-L3714) provide [methods](http://swiftmailer.org/docs/headers.html#text-headers) for stripping out newlines to prevent header injection attacks.

> **Comments:**
> **username_0**: Thanks for the response Brad. That's a very helpful description to return to our client with.  

---

