Php Email Form Validation - V3.1 Exploit

$email = filter_var($_POST['email'], FILTER_SANITIZE_EMAIL);
if (!filter_var($email, FILTER_VALIDATE_EMAIL)) 
    die("Invalid email");
// Additional header injection cleanup
$email = str_replace(array("\r", "\n", "%0a", "%0d"), '', $email);

Attackers use the vulnerable form to send thousands of spam emails. Because the email originates from your trusted server IP, your domain's reputation is destroyed, leading to blacklisting by Spamhaus, Barracuda, and Microsoft.

When the mail() function processes the $headers string, the resulting header block becomes: php email form validation - v3.1 exploit

From: attacker@evil.com
Bcc: thousands@targets.com
Reply-To: attacker@evil.com

The \r\n characters terminate the From: header prematurely and inject a new Bcc: header. The PHP mail() function (especially on older Unix sendmail systems) will honor this injected header, causing the server to send blind carbon copies of the contact form message to every address in the Bcc list. Attackers use the vulnerable form to send thousands