Note that there are some explanatory texts on larger screens.

plurals
  1. PO
    primarykey
    data
    text
    <p>You are not required to sanitize anything before sending to phpMailer except checking if the email address entered is valid email address or not.</p> <p>Data sanitization are for 2 reasons : SQL injection and XSS or CSRF (Xross Site Scripting or Cross site Request Forgery) In either of cases, user has to see something as output based on their input.</p> <p>However, it is good that you asked about sanitization for mail classes because, ideally no one will ask for it. HTML tags? Ofcourse you can send HTML tags! You can define <a href="http://www.w3.org/TR/html4/types.html#h-6.7">content-type</a> as <code>text/html</code></p> <p><strong>What you need to sanitize?</strong></p> <ol> <li><p>Attachment type! Irrespective of mail-client exploit is always found in attachments. Allow only following mime-types: </p> <p>image/jpeg', 'image/pjpeg', 'image/gif', 'image/png', 'application/msword', 'application/vnd.ms-office', 'application/vnd.openxmlformats-officedocument.wordprocessingml.document', 'application/vnd.openxmlformats-officedocument.wordprocessingml.template', 'application/vnd.openxmlformats-officedocument.spreadsheetml.sheet', 'application/vnd.openxmlformats-officedocument.presentationml.presentation','application/pdf'</p></li> </ol> <p>Checking for Extentions of the file is NOT recommended! Because, the mail client might use functions like get_file_contents() which will just open the file in browser and if it is javascript embedded with an extension of JPEG, it will STILL execute! (in IE6/IE7 it did) however, that again is browsers job to have powerful parsing mechanism. <a href="http://www.garage4hackers.com/f11/gmail-xss-vulnerability-through-content-sniffing-2094.html">Content-Sniffing</a></p> <ol> <li>Size of attachments</li> </ol> <p>Make sure you have size limit.</p> <p>Exploit may or may not be in the mail, mail client has to take care of it. However, as a mailer-end coder, these are 2 things which you should take care of.</p> <p>Hope that helps :)</p>
    singulars
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    plurals
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. VO
      singulars
      1. This table or related slice is empty.
    2. VO
      singulars
      1. This table or related slice is empty.
    3. VO
      singulars
      1. This table or related slice is empty.
    1. This table or related slice is empty.
 

Querying!

 
Guidance

SQuiL has stopped working due to an internal error.

If you are curious you may find further information in the browser console, which is accessible through the devtools (F12).

Reload