Cleaning user input before sending it in mail

Question

I am using PHPMailer class to send mails. Some mails contain user input. Should I clean user input before inserting it to mail body ? How to do this?

Tried to google for it but haven't fount anything useful.

Answer 1

是的，您应该ALWAYS清理/清除用户输入，以防止代码或SQL注入。

Answer 2

Sanitation is always key when handling user input.

• You can use strip_tags to limit the HTML tags they're allowed to use, if any.
• htmlspecialchars will properly change things like < into < so they can't be evaluated as HTML.
• If inserting content into a database, use the proper escape function:
  • PostgreSQL - pg_escape_string
  • mySQL - mysql_real_escape_string