Quoting/Escaping variables in mail body
问题 I am feeling a bit awkward, because I am generating a mail-body with PHP without escaping the variables. In HTML I am using htmlspecialchars() or similar functions, for command lines escapeshellarg(), but for mails? For example something like this: <?php $usercontent = $_GET['usercontent']; mail("dummy@nowhere.tld", "My Subject", "My body with $usercontent included"); ?> What could a possible attacker do with a script like the one above and how could I protect against such an attack? Or is