Question

I understand about mysql_real_escape_string and such, But what about when i am just sending an email?

So I have form, and a textbox, is there any vulnerabilities in just directly emailing the $_POST data to a user? I guess they wouldnt be able to execute any PHP.. or can they if they run it from a web address? I am not sure.

Answer 1

If it is being sent directly to an email then it will be fine. If it is being stored in a database to be displayed on an administrator page such as a helpdesk, etc. then it will need to be escaped for both html output and mysql. You can escape mysql using a number of functions:

• If using PDO then use prepare statement :
  http://php.net/manual/en/pdo.prepare.php
• Otherwise I would use :
  http://php.net/manual/en/mysqli.real-escape-string.php

That said because Emails can contain HTML, if you don’t want to receive emails that people have put bogus HTML in such as <blink> (Which is really annoying) then you can use htmlspecialchars() : http://php.net/manual/en/function.htmlspecialchars.php

If you are worried about Javascript in emails then using htmlspecialchars() noted above will escape this also.