\subsection{Languages Affected}
\label{languages}
\noindent{\textbf{PHP}} was the first language found vulnerable to \ehi in its implementation of the \texttt{mail()} function at the time of release of PHP~4.0. According to w3techs~\cite{W3techs}, PHP is used by 81.9\% of all websites.

After 13 further iterations of PHP since the 4.0 release (the current
version is 7.1), the \texttt{mail()} function is yet to be fixed after
15 years. However, the PHP documentation~\cite{PHPDocs} specifies that the \texttt{mail()} function does not protect against \ehi.
A working code sample with the vulnerability is shown in  Listing~\ref{code:phpemi}.

\begin{sloppypar}
A bug was filed about an \ehi vulnerability in Python's implementation of the \texttt{email.header} library and the header parsing functions allowing newlines in early 2009, which was followed by a partial patch in 2011.
\end{sloppypar}

Unfortunately, the bug fix was only for the \texttt{email.header} package, and not for other frequently used packages such as \texttt{email.parser}, where both the classic \texttt{Parser()} and the newer \texttt{FeedParser()} contain \ehi vulnerabilities even in the latest versions: \texttt{2.7.11} and \texttt{3.5}. The bug fix was also not backported to older versions of Python.
There is no mention of the vulnerability in the Python documentation for either library. Contrary to PHP's behavior of overwriting existing headers, Python only recognizes the first occurrence of a header, and ignores duplicate headers.

%A working code sample of the vulnerability, written in Python 2.7.11, is shown in Listing~\ref{code:pyemi}.

%\input{Background/py.tex}

Java has a bug report about \ehi filed against its \texttt{JavaMail} API. A detailed write-up by Alexandre Herzog~\cite{Herzog.2014} contains a proof-of-concept program that exploits the API to inject headers.

\begin{sloppypar}
From our preliminary testing, Ruby's built-in \texttt{Net::SMTP} library also has an \ehi vulnerability (not documented on the library's homepage).
%A working code sample of the vulnerability, written in Ruby 2.0.0 (the latest stable version at the time of writing), is shown in Listing~\ref{code:rubyemi}.
\end{sloppypar}
%\input{Background/ruby.tex}


