Sendmail duplicating emails

[Guest_imported]

I am using a postcard script that uses sendmail to send an email to notify of the postcard.

The follow peice of code:

open (MAIL, "|$mailprog $input{'address'}&quot || die "Can't open $mailprog!\n";
print MAIL "Reply-to: $input{'senderemail'}\n";
print MAIL "From: $input{'senderemail'}\n";
print MAIL "To: $input{'address'}\n";
print MAIL "Subject: $subject\n\n";
open (PAGE, "$mail_message&quot || die ("I am sorry, but I was unable to open the file
$thank_you."
while (<PAGE>) {
s/%%sender%%/$input{'sender'}/g;
s/%%userid%%/$userid/g;
print MAIL $_;
}
close (PAGE);
close (MAIL);

In the above, $mailprog is path to sendmail, $input{'address') and $mail_message is a template email.

The script sends out two identical emails.

any ideas.

Ric

 

[pkiller]

that's not a problem of perl itself (your code is ok),
but a problem regarding the data you are feeding to
sendmail.

you are using the form &quot;sendmail recipient&quot; and also
specifying on the head &quot;To: ...&quot;.

Try only one of them:

1. using the &quot;-t&quot; flag for sendmail, and keeping the
&quot;To: &quot; header but no recipient on the command line.
--> open (MAIL, &quot;|$mailprog -t&quot

2. keep the open() as it is now, but remove the &quot;To:&quot;
on the header portion

--
pkiller

 

[tsdragon]

Using the -t flag for sendmail, and putting the recipient in the &quot;To: &quot; header is the recommended method, for very good security reasons. If you put the recipients email address on the command line, and someone entered an &quot;email address&quot; of `rm -r *`, you could be in REAL trouble. It's much safer never to allow user-entered input on a command line. That &quot;email address&quot; wouldn't hurt anything if it appeared in a &quot;To: &quot; header.
Tracy Dryden
tracy@bydisn.com

Meddle not in the affairs of dragons,
For you are crunchy, and good with mustard.

 

[Guest_imported]

Well thanks guys you have ssaved my life!!! The email field was checked for @'s and .'s so it should have been safeish! on the command line but I took you advice and removed the command line aspect anyway!

Thanks again.

Ric

 

[tsdragon]

The worst thing to allow on an email address is the backtick, since it invokes a shell to execute the part enclosed in backticks and substitute the result into the command. NEVER allow a backtick in any user input that is going to be used on a command line!
Tracy Dryden
tracy@bydisn.com

Meddle not in the affairs of dragons,
For you are crunchy, and good with mustard.