I am adding a feedback form to a web page and would like to know if it is safe to simply filter the contents of the TEXTAREA element (after decoding) through the 'mail' command to send an e-mail to the page's maintainer.
I have looked at the man page and cannot see a way to abuse this, in particular as long as 'mail' does not run in interactive mode, tilde escapes are disabled and '.' on a line by itself does not terminate the message body.
But is there any other danger I should be aware of?
The command looks something like:
echo "$MESSAGE_BODY" | mail [email protected] -s 'Website feedback'