Question

I want to check some string before sending an email.
I have 3 fields: name + email + text

I’m wondering if mysql_escape_string is good even If I’ll not insert the values into a sql table. So I used:

PHP code:

  $name = trim($name);
  $name = strip_tags($name);
   # etc 

Question:

It’s enough?

EDIT:
I want to remove HTML Tags (Expet <p> & <br /> from the Text Field) + Trim the strings

Answer 1

If you want to remove all HTML Tags except <p> & <br />:

$name = strip_tags(trim($name), '<p><br>');

Second argument to strip_tags^­Docs is the allowed tags. But you can not specify which attributes to preserve or drop for the tags with that function.

I’m pretty sure how to do that has been already asked on this site, so you should take a search or look at this duplicate:

• PHP function to strip tags, except a list of whitelisted tags and attributes