NYCPHP Meetup

[Hans Zaunere]

Hans C. Kaspersetz scribbled on Thursday, September 15, 2005 7:13 AM:
> This might be a silly question, but with this solution are you still
> vulnerable if the hack comes in another character encoding?

That's a good question.  I believe that headers are expected to be in
US-ASCII.  While that's how it was in the original spec, there may be
addendum specs that I'm not aware of (I don't read RFCs for a living anymore
:)

Most MTAs will likely break with non-ASCII headers anyway, even if it's
allowed in some RFC.  Again, there are likely fringe cases, but most who use
sendmail/postfix/your-mta-hear are probably immune.


---
Hans Zaunere / President / New York PHP
   www.nyphp.org  /  www.nyphp.com