PHP input sanitizer function?

Question

What's a method to sanitize PHP POST data for passing to a mail function? (I prefer a method that's not part of the mysql_function() family of functions.)

I take the data, sanitize it, print it back to the user and send it in an email to a preset address.

EDIT: I'm just sending the email to our email address so we can send out a mailing to the address in the email.

That depends on what the mail function is doing with the data. — cdhowie
– cdhowie, Commented Dec 3, 2010 at 20:41
@cdhowie - I want to send the email to an address! That's all. — Moshe
– Moshe, Commented Dec 3, 2010 at 20:49
@Moshe The input code doesn't know what kind of sanitization the sink function needs. There are so many ways to escape/sanitize data(html, sql, file-path,...) and the input layer of the code doesn't know which one to apply. — CodesInChaos
– CodesInChaos, Commented Dec 5, 2010 at 9:38

Shaun Hare · Accepted Answer · 2010-12-03 20:57:39Z

1

Have you looked at the filter functions e.g http://www.php.net/manual/en/function.filter-var.php

answered Dec 3, 2010 at 20:57

Shaun Hare

3,8712 gold badges26 silver badges36 bronze badges

Sign up to request clarification or add additional context in comments.

Comments

Community · Accepted Answer · 2017-05-23 12:18:39Z

0

Since you're printing it back to the user, you need to escape any HTML content.

strip_tags() and html_special_chars() are quite useful in filtering the message content, especially if you're using html messages.

See also:
How to sanitze user input in PHP before mailing?
which mentions doing a find & replace on newlines that could allow injecting content into the mail headers.
As you're using a pre-set mail address the risk is reduced, but the subject field is still vulnerable.

edited May 23, 2017 at 12:18

CommunityBot

11 silver badge

answered Dec 3, 2010 at 20:45

dig412

5411 gold badge6 silver badges15 bronze badges

3 Comments

ThiefMaster Over a year ago

There's no good reason to escape HTML in an email.. especially if it's a plaintext email.

Moshe Over a year ago

@ThiefMaster, But what about sanitizing for the handling of the data before I send the email?

dig412 Over a year ago

Certainly, but we don't know what he's doing with the email. Covering all the bases, even if you only expect text emails at the start, is a good tactic.

Alin P. · Accepted Answer · 2010-12-03 20:42:29Z

0

Sanitizing for an e-mail would be equivalent to sanitizing for HTML output. I see some suggestions on SO for HTML Purifier.

answered Dec 3, 2010 at 20:42

Alin P.

44.5k13 gold badges79 silver badges93 bronze badges

4 Comments

ThiefMaster Over a year ago

Why would you escape HTML in a plaintext email? I think he wants to protect against header injection.

Alin P. Over a year ago

@ThiefMaster Who said anything about plain text? Most of the emails are HTML nowadays so they should be checked for HTML injection. I don't think he referred to header injection. Why would he print the headers back to the user?

ThiefMaster Over a year ago

Most emails are HTML? Not really.. luckily. HTML emails are a pest.

Alin P. Over a year ago

@ThiefMaster I don't know what mails you receive or send but what I use and work with is HTML.

Collectives™ on Stack Overflow

PHP input sanitizer function?

3 Answers 3

Comments

3 Comments

4 Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

3 Answers 3

Comments

3 Comments

4 Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related