RE: [PHP] [Q] mail() & security
| From: | Chris W. Parker | Date: | Mon, 04 Apr 2005 22:29:14 +0000 |
| Subject: | RE: [PHP] [Q] mail() & security | ||
| Groups: | php.general | ||
| Request: | Send a blank email to php-general+get-212215@lists.php.net to get a copy of this message | ||
Eric Gorr <mailto:mailist@ericgorr.net>
on Monday, April 04, 2005 3:13 PM said:
> Remember, the text being processed goes straight from $_POST[ 'body' ]
> through strip_tags (+ more?) into mail().
Remember? You didn't mention this is your original email so how could I
be told to recall this information? In your specific case addslashes()
is probably not necessary.
> It seems as if strip_tags strip out everything that htmlentities would
> change and would therefore be unnecessary.
strip_tags() and htmlentities() both perform seperate functions (hence
they have different names). htmlentities() encodes special characters,
strip_tags() strips HTML from a string. One example is the following:
Original: <b>&</b>
With strip_tags applied: &
With htmlentities applied: &
It may or may not be necessary for you.
Chris.