Cleaning user input before sending it in mail

Question

I am using PHPMailer class to send mails. Some mails contain user input. Should I clean user input before inserting it to mail body? How to do this?

Tried to google for it but haven't fount anything useful.

Answer 1

Sanitation is always key when handling user input.

• You can use strip_tags to limit the HTML tags they're allowed to use, if any.
• htmlspecialchars will properly change things like < into < so they can't be evaluated as HTML.
• If inserting content into a database, use the proper escape function:
  • PostgreSQL - pg_escape_string
  • mySQL - mysql_real_escape_string

Answer 2

Yes, you should ALWAYS sanitize/clean user input to prevent code or SQL injections.