Re: [Q] mail() & security
| From: | Josip Dzolonga | Date: | Mon, 04 Apr 2005 23:03:31 +0000 |
| Subject: | Re: [Q] mail() & security | ||
| References: | 1 2 3 | Groups: | php.general |
| Request: | Send a blank email to php-general+get-212220@lists.php.net to get a copy of this message | ||
Eric Gorr wrote:
Shouldn't strip_tags be enough? What dangerous/annoying things might happen if I replaced htmlentities with strip_tags in the above function and then passed the body text to the mail() function?Nothing, but with htmlentities() you can be sure if the user has tried to inject something malicious :-). -- Josip Dzolonga http://josip.dotgeek.org jdzolonga[at]gmail.com