# Email injection

**URL:** <https://www.ruby-forum.com/t/email-injection/139216>\
**Category:** Rails\
**Created:** [June 2, 2008, 12:06am UTC](https://www.ruby-forum.com/t/email-injection/139216 "2008-06-02T00:06:38Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![northwind](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/n/ad7895/32.png) [@northwind](https://www.ruby-forum.com/u/northwind)\
**Post date:** [June 2, 2008, 12:06am UTC](https://www.ruby-forum.com/t/email-injection/139216/1 "2008-06-02T00:06:38Z")

</div>

Hello,  
When sending e-mail from rails, I am wondering if there is a need to  
filter post data from forms to prevent email injection attacks; or, if  
ActionMailer is designed to protect against them. I have done a few  
simple tests by trying to add newlines, and cc’s, using code similar  
to injection through php, and ActionMailer has converted them to  
simple strings. I haven’t seen any mention or cautions of injection  
attacks in either Agile Web D., or Beginning Rails by Apress;  
nor, do I find anything significant from googling. Any search done  
regarding email injection attacks when using php brings too many  
results to count.

Is it something taken care of by ActionMailer, or do folks usually  
roll their own filter methods?

If it is needed can anyone point me to a blog or tutorial with some  
information?

Thanks.  
Scott.