I have tested this item ✅ successfully on ee761cb

This PR is included in PR #20265.

Sorry for not noticing it here. Yes i have 'stolen' this one so we have the complete code in the other PR as the check needed to be extended anyway. Many thanks @Quy !

if (!empty($_POST[$field]))

This check is no longer required when using $data and getData() in your PR. Please consider my suggestion in your PR.

Why should it no longer required?

Here is my proposed change:

remove:

		// An array of the input fields to scan for injected headers
		$fields = array(
			'emailto',
			'sender',
			'emailfrom',
			'subject',
			'link',
			'captcha',
		);

change to:

		foreach ($data as $key => $value)
		{
			foreach ($headers as $header)
			{
				if (strpos($value, $header) !== false)
				{
					JError::raiseError(403, '');
				}
			}
		}

In other words, you got the data here so no need to do this check if (!empty($_POST[$field])).

	public function getData()
	{
		$input = JFactory::getApplication()->input;
		$data['emailto']   = $input->get('emailto', '', 'string');
		$data['sender']    = $input->get('sender', '', 'string');
		$data['emailfrom'] = $input->get('emailfrom', '', 'string');
		$data['subject']   = $input->get('subject', '', 'string');
		$data['captcha']   = $input->get('captcha', '', 'string');
		return $data;
	}

Pushed thanks ?