Re: [Q] mail() & security
| From: | Eric Gorr | Date: | Mon, 04 Apr 2005 22:44:53 +0000 |
| Subject: | Re: [Q] mail() & security | ||
| References: | 1 | Groups: | php.general |
| Request: | Send a blank email to php-general+get-212217@lists.php.net to get a copy of this message | ||
Chris W. Parker wrote:
What dangerous/annoying things might happen if I did not pass the text intended for the body parameter of the mail function through htmlentities? (But, did pass it through strip_tags) I cannot come up with anything.It seems as if strip_tags strip out everything that htmlentities would change and would therefore be unnecessary.strip_tags() and htmlentities() both perform seperate functions (hence they have different names). htmlentities() encodes special characters, strip_tags() strips HTML from a string. One example is the following: Original: <b>&</b> With strip_tags applied: & With htmlentities applied: & It may or may not be necessary for you.