|
Posted by Josip Dzolonga on 04/05/05 02:03
Eric Gorr wrote:
> Shouldn't strip_tags be enough? What dangerous/annoying things might
> happen if I replaced htmlentities with strip_tags in the above
> function and then passed the body text to the mail() function?
Nothing, but with htmlentities() you can be sure if the user has tried
to inject something malicious :-).
--
Josip Dzolonga
http://josip.dotgeek.org
jdzolonga[at]gmail.com
Navigation:
[Reply to this message]
|