RE: [Q] mail() & security

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



Eric Gorr <mailto:mailist@xxxxxxxxxxxx>
    on Monday, April 04, 2005 3:13 PM said:

> Remember, the text being processed goes straight from $_POST[ 'body' ]
> through strip_tags (+ more?) into mail().

Remember? You didn't mention this is your original email so how could I
be told to recall this information? In your specific case addslashes()
is probably not necessary.

> It seems as if strip_tags strip out everything that htmlentities would
> change and would therefore be unnecessary.

strip_tags() and htmlentities() both perform seperate functions (hence
they have different names). htmlentities() encodes special characters,
strip_tags() strips HTML from a string. One example is the following:

Original: <b>&</b>

With strip_tags applied: &

With htmlentities applied: &amp;

It may or may not be necessary for you.


Chris.

-- 
PHP General Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php



[Index of Archives]     [PHP Home]     [Apache Users]     [PHP on Windows]     [Kernel Newbies]     [PHP Install]     [PHP Classes]     [Pear]     [Postgresql]     [Postgresql PHP]     [PHP on Windows]     [PHP Database Programming]     [PHP SOAP]

  Powered by Linux