Mystery

[Necron99]

I have a theory, but I'd like your opinion. Here's the problem:

HTML form gathers data and submits to a PHP file. PHP file extracts POST data and emails it to recipients contained in a static string (i.e., $string = "name1@host.com, name2@otherhost.net"; ). Someone is, at some point, appending different email addresses onto the "To:" field. The resulting list is "name1@host.com, name2@otherhost.net,bogusname@bogus.com".

It's not being done directly (I checked the two files). The mail is being intercepted and fooled with (or so it seems to me).

Anybody got any ideas? How would you do it?

Dave

[pmbinky]

Hmmm. I'm just stabbing in the dark here but is it possible that the page can be called with an argument, ie. the bogus email, and then execute that actual php to email the form data?

There shouldn't be any way that the source can be accessed directly since php is supposed to be server side.

I am also curious as to how this could happen since one of my biggest peeves is spam.