php - 如何在邮件发送前清理 PHP 中的用户输入？

Question

我有一个简单的 PHP 邮件程序脚本，它从通过 POST 提交的表单中获取值并将它们邮寄给我:

<?php
$to = "me@example.com";

$name = $_POST['name'];
$message = $_POST['message'];
$email = $_POST['email'];

$body  =  "Person $name submitted a message: $message";
$subject = "A message has been submitted";

$headers = 'From: ' . $email;

mail($to, $subject, $body, $headers);

header("Location: http://example.com/thanks");
?>

如何清理输入？

Answer 1

使用 filter_var() 清理 post 变量.

Example here .喜欢:

echo filter_var($_POST['email'], FILTER_SANITIZE_EMAIL);