Checking the 'message' parameter of the mail function

[Eric]

I would imagine it is a fairly common situation for a site to allow the
user to enter some text into a field and then to have that text passed
to the 'message' parameter of the mail function
(http://us4.php.net/manual/en/function.mail.php).

Is it a good idea to pass this text through some other function first or
can it be sent through as is? Is this a case where the maxim 'do not
trust input from the user' does not apply?

[C.Schneck]

I would usually make my own function to remove any potentially harmful text
like html characters before including it in an email message. Sterlizing
user input is most always a necessity.

"Eric" <eg******@verizon.net> wrote in message
news:1ghca1j.1m4i6r81wy2qdcN%eg******@verizon.net. ..

I would imagine it is a fairly common situation for a site to allow the
user to enter some text into a field and then to have that text passed
to the 'message' parameter of the mail function
(http://us4.php.net/manual/en/function.mail.php).

Is it a good idea to pass this text through some other function first or
can it be sent through as is? Is this a case where the maxim 'do not
trust input from the user' does not apply?

[Eric]

C.Schneck <ch***@nisa.com> wrote:

"Eric" <eg******@verizon.net> wrote in message
news:1ghca1j.1m4i6r81wy2qdcN%eg******@verizon.net. ..

I would imagine it is a fairly common situation for a site to allow the
user to enter some text into a field and then to have that text passed
to the 'message' parameter of the mail function
(http://us4.php.net/manual/en/function.mail.php).

Is it a good idea to pass this text through some other function first or
can it be sent through as is? Is this a case where the maxim 'do not
trust input from the user' does not apply?

I would usually make my own function to remove any potentially harmful text
like html characters before including it in an email message. Sterlizing
user input is most always a necessity.

Surely such functions must exist in great abundance...do you happen to
have one hanging around somewhere?

[C.Schneck]

i post this one a lot, htmlspecialchars() its really handy.

also depending on your php configuration addslashed() is another one you
could consider.

"Eric" <eg******@verizon.net> wrote in message
news:1ghdfs6.twyiyg12dpkgkN%eg******@verizon.net.. .

C.Schneck <ch***@nisa.com> wrote:

"Eric" <eg******@verizon.net> wrote in message
news:1ghca1j.1m4i6r81wy2qdcN%eg******@verizon.net. ..

I would imagine it is a fairly common situation for a site to allow the user to enter some text into a field and then to have that text passed
to the 'message' parameter of the mail function
(http://us4.php.net/manual/en/function.mail.php).

Is it a good idea to pass this text through some other function first or can it be sent through as is? Is this a case where the maxim 'do not
trust input from the user' does not apply?

I would usually make my own function to remove any potentially harmful text like html characters before including it in an email message. Sterlizing
user input is most always a necessity.

Surely such functions must exist in great abundance...do you happen to
have one hanging around somewhere?