---
title: Sanitize Input Before Sending Emails
impact: MEDIUM
impactDescription: prevents email header injection
tags: email, injection, sanitization, input-validation, security
---

## Sanitize Input Before Sending Emails

Email header injection allows attackers to add recipients, change headers, or send spam through your system.

**Incorrect (unsanitized email input):**

```go
// Email injection vulnerability
subject := r.FormValue("subject") // "Hello\r\nBcc: spam@evil.com"
msg := []byte("Subject: " + subject + "\r\n\r\n" + "Body")
smtp.SendMail("smtp.example.com:25", auth, from, to, msg)
```

**Correct (sanitized email fields):**

```go
func sanitizeEmailField(input string) string {
    // Remove CRLF characters that could inject headers
    return strings.NewReplacer("\r", "", "\n", "").Replace(input)
}

func validateEmail(email string) bool {
    // Use a robust regex or net/mail
    _, err := mail.ParseAddress(email)
    return err == nil && !strings.ContainsAny(email, "\r\n")
}

// In handler
subject := sanitizeEmailField(r.FormValue("subject"))
to := r.FormValue("to")
if !validateEmail(to) {
    http.Error(w, "Invalid email", 400)
    return
}
```

**Tools:** Email Libraries with Built-in Protection, Manual Review, `net/mail`